@ketecode/loom 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,517 @@
-# Temporary Holding Version
+<p align="center">
+  <img src="assets/brand/kete-loom.svg" alt="Kete Loom" width="96" />
+</p>
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+<h1 align="center">Kete Loom</h1>
+
+<p align="center"><strong>Curated, tested Agent Skills, subagents and commands for coding agents.</strong><br/>
+One source. Installs unchanged in Claude Code, Codex, OpenCode, Cursor, Gemini CLI, GitHub Copilot and Kete Code.</p>
+
+<!-- languages:start -->
+<p align="center"><a href="README.md">English</a> · <a href="docs/i18n/README.ar.md">العربية</a> · <a href="docs/i18n/README.de.md">Deutsch</a> · <a href="docs/i18n/README.es.md">Español</a> · <a href="docs/i18n/README.fr.md">Français</a> · <a href="docs/i18n/README.ja.md">日本語</a> · <a href="docs/i18n/README.pt-BR.md">Português (Brasil)</a> · <a href="docs/i18n/README.sw.md">Kiswahili</a> · <a href="docs/i18n/README.zh-CN.md">简体中文</a> · <a href="https://kete-org.github.io/kete-loom/">Browse the catalog ↗</a></p>
+<!-- languages:end -->
+
+---
+
+Kete Loom is the skills library behind [Kete Code](https://ketecode.ai). It ships three kinds of items: **skills** (folders the agent loads when relevant), **agents** (subagents it delegates to) and **commands** (slash commands you type). It takes a quality-first approach: fewer items, and every one of them is
+
+- **portable**: uses the strictest common subset of the [Agent Skills](https://agentskills.io) format, so no host rejects it;
+- **tested**: skills and agents ship trigger evals that check they load for the right requests and stay out of the way for the wrong ones;
+- **short**: under 300 lines, with detail moved into `references/` that the agent reads only when needed;
+- **versioned and labelled**: semver, category and a risk level (`read-only`, `writes-files`, `runs-commands`, `network`) in its metadata;
+- **script-backed** where the work is deterministic.
+
+## Install
+
+### Any agent (recommended)
+
+```bash
+npx @ketecode/loom install
+```
+
+This installs every skill into `~/.agents/skills` (read by Codex, OpenCode, Cursor, Gemini CLI, GitHub Copilot and Kete Code) and `~/.claude/skills` (Claude Code). Agents and commands go into `~/.claude/agents` and `~/.claude/commands` (read by Claude Code, and for agents also Cursor and VS Code Copilot), and into Codex, OpenCode, Gemini CLI and Kete Code's own folders when those hosts are installed. Each agent and command is converted to the format its host expects. Restart your agent afterwards.
+
+Or pick a profile instead of installing everything:
+
+| Profile | What it installs |
+|---|---|
+| `minimal` | Test-first work, verification, security review, code review |
+| `core` | The essentials, planning, git, onboarding and session handoff, **plus the language and framework packs your project uses** (detected from `package.json`, `go.mod`, `pyproject.toml`, `Cargo.toml`, `Dockerfile` and so on) |
+| `developer` | `core` plus the four safety hooks |
+| `security` | Every security and compliance item, plus the safety hooks |
+| `ai`, `data` | `core` plus every AI or data item |
+| `business` | Marketing, research, investor, writing, PRD and operations skills |
+| `full` | Everything, including every hook |
+
+```bash
+npx @ketecode/loom install --profile developer     # run it inside your project so detection sees it
+npx @ketecode/loom profiles                        # what each profile would install here
+```
+
+Profiles combine with `--skill`, `--agent`, `--command` and `--hook`, and `uninstall --profile <name>` removes only that profile's items.
+
+Common options:
+
+```bash
+npx @ketecode/loom install --project                       # into this repo (.agents/ and .claude/), commit it for your team
+npx @ketecode/loom install --skill tdd-workflow,security-review
+npx @ketecode/loom install --agent code-reviewer --command verify
+npx @ketecode/loom install --target claude                  # one host only
+npx @ketecode/loom install --dir ~/.some-agent/skills       # any other agent
+npx @ketecode/loom doctor                                   # what's installed, and which hosts can see it
+npx @ketecode/loom uninstall                                # removes only items kete-loom installed
+```
+
+No Node? Use the shell installers, which fall back to a plain copy of the skills (agents and commands need the Node installer):
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/Kete-org/kete-loom/main/install.sh | bash
+```
+
+```powershell
+irm https://raw.githubusercontent.com/Kete-org/kete-loom/main/install.ps1 | iex
+```
+
+### Native plugin installs
+
+| Host | Command |
+|---|---|
+| Claude Code | `/plugin marketplace add Kete-org/kete-loom` then `/plugin install kete-loom@kete-loom` |
+| Codex | `codex plugin marketplace add Kete-org/kete-loom` then `codex plugin add kete-loom@kete-loom` |
+| Gemini CLI | Use the `npx` installer (Gemini reads `~/.agents/skills`). A `gemini-extension.json` is included for `gemini extensions install https://github.com/Kete-org/kete-loom` (experimental) |
+| Any skills CLI | `npx skills add Kete-org/kete-loom` |
+
+Plugin installs update through the host's own plugin manager. Use either a plugin install or the `npx` installer for a given host, not both, or the host may list each skill twice.
+
+## Skills
+
+<!-- catalog:start -->
+| Name | Category | Risk | What it does |
+|---|---|---|---|
+| [`accounting-api-integration`](skills/accounting-api-integration/SKILL.md) | integrations | network | Connects an application's sales and payments to QuickBooks Online and Xero through their accounting APIs, handling the OAuth 2.0 authorisation code flow with rotating refresh tokens, per-company realm or tenant IDs, chart of accounts and tax code mapping, posting customers, invoices, payments and credit notes, safe retries with requestid or Idempotency-Key, HMAC-verified webhooks, 429 rate-limit backoff, and nightly reconciliation against the ledger. |
+| [`agent-harness-design`](skills/agent-harness-design/SKILL.md) | ai | writes-files | Architecture for the loop around an LLM agent, covering which tools to give it, how to manage and compact its context window, plan-act-verify cycles, permission tiers and sandboxing, tracing and cost limits, and recovery when steps fail or the agent loops. |
+| [`ai-media-generation`](skills/ai-media-generation/SKILL.md) | ai | network | Product features built on hosted generative image, video, speech and music models, including prompt templates with fixed parameters and seeds, long-running jobs submitted then polled or confirmed by signed webhooks, per-user quotas and cost estimates before submission, input and output moderation, C2PA content credentials and AI-generated labels, and copying results to your own storage before provider URLs expire. |
+| [`angular-patterns`](skills/angular-patterns/SKILL.md) | coding | runs-commands | Modern Angular guidance for standalone components, signal state with input(), output(), model(), computed and effect, RxJS subscriptions that cannot leak, OnPush and zoneless change detection, inject()-based dependency injection, typed reactive or signal forms, and TestBed component tests. |
+| [`api-design`](skills/api-design/SKILL.md) | coding | writes-files | HTTP API contract design covering resource modelling, REST versus RPC-style endpoints, status codes and RFC 9457 problem details, cursor pagination, filtering, versioning and deprecation headers, Idempotency-Key retries, OpenAPI-first contracts, and when GraphQL is worth it. |
+| [`architecture-decision-records`](skills/architecture-decision-records/SKILL.md) | docs | writes-files | Writes and maintains Architecture Decision Records (ADRs), deciding whether a choice deserves one, filling a short template (Nygard sections plus options considered) with context, the options weighed, the decision and its consequences, numbering and storing it next to the code, and superseding old records instead of rewriting them. |
+| [`article-writing`](skills/article-writing/SKILL.md) | business | read-only | Long-form article and blog post writing, from choosing a sharp angle and outlining, through gathering evidence and drafting in plain prose, to a structured editing pass and a final headline, summary and meta description. |
+| [`aspnet-core-patterns`](skills/aspnet-core-patterns/SKILL.md) | coding | runs-commands | ASP.NET Core web API and app hosting decisions - choosing minimal APIs or controllers, ordering the middleware pipeline, picking singleton, scoped or transient lifetimes without captive dependencies, binding and validating settings with the options pattern, request validation, JWT or cookie authentication with policy-based authorization, RFC 7807 problem details for errors, and liveness and readiness health checks. |
+| [`auth-patterns`](skills/auth-patterns/SKILL.md) | security | writes-files | Implementing login, sessions and access control correctly on the server - password hashing with Argon2id or bcrypt, cookie sessions versus JWT access tokens, OAuth 2.1 and OpenID Connect authorization code flow with PKCE, TOTP and passkey MFA, role- and attribute-based permission checks, safe token storage in browsers and mobile apps, and password reset and account recovery. |
+| [`autonomous-loops`](skills/autonomous-loops/SKILL.md) | meta | runs-commands | Runs an agent unattended over many iterations without it drifting or doing damage. |
+| [`aws-patterns`](skills/aws-patterns/SKILL.md) | devops | network | Designs and reviews workloads on Amazon Web Services, covering least-privilege IAM roles and policies, picking Lambda versus ECS Fargate versus EC2, S3 bucket hardening, RDS and Aurora setup, VPC subnets and security groups, Secrets Manager and Parameter Store, and the bill surprises that come from NAT gateways, public IPv4 and idle resources. |
+| [`azure-patterns`](skills/azure-patterns/SKILL.md) | devops | network | Sets up and audits Microsoft Azure workloads with Entra ID and managed identities instead of stored credentials, Azure RBAC at resource scope, a reasoned choice among App Service, Container Apps, Azure Functions and AKS, Azure SQL and Cosmos DB configuration, Key Vault references, virtual networks with private endpoints and NSGs, and Azure spending pitfalls like idle App Service plans and over-provisioned RUs. |
+| [`benchmark-methodology`](skills/benchmark-methodology/SKILL.md) | testing | runs-commands | Designs and runs performance benchmarks whose numbers hold up, with warmup, enough iterations, medians and p95/p99 with spread, a quiet and pinned machine, interleaved before/after comparison with a significance check, and guards against dead-code elimination and other microbenchmark traps in Go, JMH, BenchmarkDotNet, Criterion, pytest-benchmark and JS. |
+| [`bgp-diagnostics`](skills/bgp-diagnostics/SKILL.md) | devops | read-only | Diagnoses Border Gateway Protocol problems on Cisco, Juniper, Arista and FRR routers by reading neighbor state (Idle, Active, OpenSent, Established) and NOTIFICATION codes, checking which prefixes are received, accepted and advertised through prefix-lists, route-maps and max-prefix limits, walking best-path selection, decoding standard and large communities, spotting RPKI-invalid or leaked routes, and confirming what the internet sees from RIPEstat, RouteViews and other looking glasses. |
+| [`bioinformatics-workflows`](skills/bioinformatics-workflows/SKILL.md) | data | runs-commands | Bioinformatics pipeline work on FASTA, FASTQ, SAM/BAM/CRAM and VCF files with Biopython, samtools, bcftools, seqkit, FastQC, aligners such as bwa-mem2 and minimap2, and Snakemake or Nextflow workflows run in pinned conda, Docker or Apptainer environments so results reproduce. |
+| [`brand-voice`](skills/brand-voice/SKILL.md) | business | read-only | Defines a company's written brand voice as three to five attributes with "this, not that" boundaries, paired do and don't rewrites, a preferred and banned vocabulary list and tone shifts by context, then checks or rewrites copy against that guide. |
+| [`browser-qa`](skills/browser-qa/SKILL.md) | testing | runs-commands | Exploratory, manual-style QA session on a running web app through a real browser, walking the critical user journeys, abusing forms and validation, spot-checking small screens, keyboard use and contrast, and watching the console and network panel, then filing reproducible bug reports. |
+| [`bun-runtime`](skills/bun-runtime/SKILL.md) | coding | runs-commands | Working with Bun as a JavaScript runtime, package manager, test runner and bundler, and knowing where it differs from Node and npm, including bun.lock and trustedDependencies, bunfig.toml, bun test with bun:test mocks, bun build and --compile, Bun.serve, automatic .env loading, Node API compatibility gaps, and when to stay on Node. |
+| [`cisco-ios-config`](skills/cisco-ios-config/SKILL.md) | devops | read-only | Reads and writes Cisco IOS and IOS-XE running configuration by hand without cutting off access, covering access and trunk switchports, VLANs and VTP, named extended ACLs edited by sequence number, static routes and basic OSPF, SSH and local user hardening, config archive with configure replace and revert timers, and the show commands that prove each change worked. |
+| [`clickhouse-patterns`](skills/clickhouse-patterns/SKILL.md) | data | runs-commands | ClickHouse table and query design for analytics, choosing a MergeTree family engine, ordering the sorting key for the filters that matter, keeping partitions coarse, building incremental and refreshable materialised views, batching or async-inserting writes to avoid too many parts, and reading EXPLAIN and system tables to make slow queries fast. |
+| [`clinical-decision-support`](skills/clinical-decision-support/SKILL.md) | compliance | writes-files | Engineering discipline for software that recommends or warns at the point of care, including CDS Hooks services (discovery, patient-view and order-sign hooks, prefetch, cards, suggestions, feedback), alert design that avoids alert fatigue, versioned rule logic tied to cited evidence, clinician sign-off and regression testing on synthetic cases, override and audit trails, and the regulatory line where software becomes a medical device (FDA CDS guidance, EU MDR Rule 11, UK DCB0129). |
+| [`code-tour`](skills/code-tour/SKILL.md) | docs | writes-files | Authors a step-by-step guided walkthrough of a codebase or a single feature as an ordered list of stops, each pinned to a file:line reference with a short explanation of what that code does and why it matters, written so a new contributor can follow it in one sitting. |
+| [`codebase-onboarding`](skills/codebase-onboarding/SKILL.md) | docs | runs-commands | Gets you productive in an unfamiliar repository fast by locating its entry points, building and running it locally, mapping modules and the main data flow, reading the tests as a specification, and ending with a one-page orientation note. |
+| [`cold-outreach-sequences`](skills/cold-outreach-sequences/SKILL.md) | business | read-only | Plans, writes and runs B2B cold outreach sequences to prospects who have not opted in - picking an ideal customer profile and a narrow segment, researching a genuine reason to write to each person, drafting short multi-touch email and LinkedIn steps with sensible spacing, staying within CAN-SPAM, GDPR and PECR, and judging results by positive replies and meetings rather than opens. |
+| [`content-repurposing`](skills/content-repurposing/SKILL.md) | business | read-only | Breaks one finished long-form source (article, talk recording, podcast episode, webinar or report) into channel-native derivatives such as LinkedIn posts, X threads, newsletter sections, short video clip scripts and quote cards, by extracting the core claims with timestamps or paragraph references, matching each to a format, and checking every derivative against the source so nothing is exaggerated, misquoted or stripped of its caveats. |
+| [`context-budget`](skills/context-budget/SKILL.md) | meta | writes-files | Keeps a long agent task inside its context window by deciding what to read in full versus search for, reading files in slices, summarising findings into a running notes file, pushing bulky reads and log analysis to subagents that return short answers, and checkpointing before the window runs out. |
+| [`conventional-commits`](skills/conventional-commits/SKILL.md) | devops | runs-commands | Writes and checks commit messages in the Conventional Commits 1.0.0 format - choosing the type and scope, marking breaking changes with "!" or a BREAKING CHANGE footer, writing a body that explains why the change was made, and adding issue footers - so changelog and semantic-version tooling can read the history. |
+| [`cpp-patterns`](skills/cpp-patterns/SKILL.md) | coding | runs-commands | Modern C++ (17/20/23) house rules for writing and restructuring code - RAII for every resource, unique_ptr/shared_ptr ownership, value semantics and the rule of zero, const-correctness, steering clear of undefined behaviour, concepts used sparingly, target-based CMake, plus sanitizer and clang-tidy setup. |
+| [`cpp-testing`](skills/cpp-testing/SKILL.md) | testing | runs-commands | Writes and runs C++ unit tests with GoogleTest or Catch2 - test fixtures, parameterised cases, gMock mocks behind interfaces, CTest registration via gtest_discover_tests or catch_discover_tests, and running the suite under AddressSanitizer and UBSan. |
+| [`csharp-patterns`](skills/csharp-patterns/SKILL.md) | coding | runs-commands | Idiomatic modern C# on .NET 8 and later, covering nullable reference types, records, pattern matching, async/await with CancellationToken, LINQ deferred-execution traps, IDisposable and IAsyncDisposable, Microsoft.Extensions.DependencyInjection lifetimes, the dotnet CLI and Roslyn analyzers. |
+| [`csharp-testing`](skills/csharp-testing/SKILL.md) | testing | runs-commands | Writes and fixes .NET tests in C# with xUnit (or the NUnit or MSTest framework already in the repo), FluentAssertions or built-in asserts, Moq or NSubstitute test doubles, WebApplicationFactory in-memory API tests and Testcontainers-backed database tests, all run through dotnet test. |
+| [`css-architecture`](skills/css-architecture/SKILL.md) | coding | writes-files | Organises stylesheets so they stay maintainable as a codebase grows, using design tokens in CSS custom properties, cascade layers to control specificity, grid and flexbox for layout, container queries for component-level responsiveness, one consistent naming or utility-first convention, and token-driven theming including dark mode. |
+| [`customs-trade-compliance`](skills/customs-trade-compliance/SKILL.md) | compliance | network | Cross-border shipping groundwork for software and operations teams, covering Harmonized System product codes, choosing and reading Incoterms 2020 rules, estimating duties, import taxes and landed cost, the data a commercial invoice needs, and screening buyers against restricted-party and sanctions lists, with a firm line on which decisions a licensed customs broker or trade lawyer must make. |
+| [`dart-patterns`](skills/dart-patterns/SKILL.md) | coding | writes-files | Writes and refactors idiomatic Dart 3 code that keeps sound null safety intact, models data with records, pattern matching and sealed class hierarchies, handles async/await, Streams and isolates without leaks or dropped futures, and manages pub dependencies and analysis_options.yaml lint sets. |
+| [`dart-testing`](skills/dart-testing/SKILL.md) | testing | runs-commands | Writes deterministic Dart and Flutter tests with package:test and flutter_test, fakes collaborators with mocktail, asserts on Futures and Streams with expectLater and stream matchers, controls time with fake_async, and sets up basic golden image tests. |
+| [`data-analysis-notebooks`](skills/data-analysis-notebooks/SKILL.md) | data | runs-commands | Keeps Jupyter and other notebook analyses reproducible from a clean kernel, with a set project layout, a pinned environment, raw data treated as read-only, pandas and polars code free of chained assignment and silent dtype or join errors, honest plots, and statistics that avoid p-hacking, multiple-comparison and leakage traps, then moves code that has settled into tested modules. |
+| [`data-pipelines`](skills/data-pipelines/SKILL.md) | data | runs-commands | Batch data pipeline engineering for extract-load-transform jobs run by an orchestrator such as Airflow, Dagster or Prefect, built so every task is idempotent and safe to rerun for any past interval, partitioned by logical date, guarded by row-count, freshness and schema checks before data is published, tolerant of late-arriving records, and traceable through lineage. |
+| [`database-migrations`](skills/database-migrations/SKILL.md) | data | runs-commands | Plans and writes zero-downtime schema migrations with the expand-migrate-contract sequence, so columns, tables and indexes can be added, renamed, retyped or dropped while old and new app versions run side by side, with batched backfills, lock and statement timeouts, tested rollbacks, and the conventions of tools such as Flyway, Liquibase, Alembic, Django, Rails, Prisma and Knex. |
+| [`dbt-patterns`](skills/dbt-patterns/SKILL.md) | data | runs-commands | dbt project conventions for analytics engineering, laying models out in staging, intermediate and marts layers, declaring sources with freshness, using ref and source instead of hard-coded tables, adding data tests, unit tests and enforced model contracts, choosing an incremental strategy, building snapshots for slowly changing history, documenting columns, and running slim CI on only the modified nodes. |
+| [`deep-research`](skills/deep-research/SKILL.md) | meta | network | Investigates a technical question across many sources and produces a cited report. |
+| [`dependency-audit`](skills/dependency-audit/SKILL.md) | security | network | Software supply-chain audit of a project's third-party packages across npm, pnpm, Yarn, pip/uv, Cargo, Go modules and similar ecosystems. |
+| [`deployment-strategies`](skills/deployment-strategies/SKILL.md) | devops | runs-commands | Plans and runs low-risk production releases with blue-green switches, progressive canary rollouts, feature flags that separate deploy from release, expand-and-contract database changes ordered so old and new code both work, readiness and liveness health checks, rollback triggered automatically by error and latency signals, and smoke tests after every deploy. |
+| [`django-patterns`](skills/django-patterns/SKILL.md) | coding | runs-commands | Django project conventions for building and changing apps, covering app layout, ORM query efficiency with select_related and prefetch_related, safe migrations, forms and model validation, auth and permission checks, per-environment settings, Celery tasks that run after commit, and production security settings. |
+| [`docker-patterns`](skills/docker-patterns/SKILL.md) | devops | runs-commands | Writes and fixes Dockerfiles and Docker Compose files that build small, cacheable, non-root images, using multi-stage builds, a tight .dockerignore, BuildKit cache and secret mounts, healthchecks, and a Compose setup for local development with dependent services. |
+| [`e2e-testing-playwright`](skills/e2e-testing-playwright/SKILL.md) | testing | runs-commands | Writes and maintains Playwright Test end-to-end suites for web apps, using role-based locators, web-first assertions that auto-wait, saved storageState for login, page.route network mocks, isolated per-test data, traces for flaky runs and a sharded CI job. |
+| [`ef-core-patterns`](skills/ef-core-patterns/SKILL.md) | coding | runs-commands | Entity Framework Core data-access rules for .NET - scoped DbContext lifetime, pooling and IDbContextFactory, AsNoTracking for read paths, LINQ that translates to SQL instead of throwing or evaluating on the client, projections, Include versus AsSplitQuery for N+1 and cartesian explosion, ExecuteUpdate and ExecuteDelete for bulk writes, safe dotnet ef migrations and idempotent scripts, and optimistic concurrency with row versions. |
+| [`email-deliverability`](skills/email-deliverability/SKILL.md) | business | network | Gets email into the inbox instead of spam by setting up SPF, DKIM, DMARC and BIMI DNS records with alignment, splitting transactional and marketing mail onto separate subdomains and streams, choosing a sending provider, processing bounces and complaints, keeping lists clean and warming a new domain or IP. |
+| [`error-handling-patterns`](skills/error-handling-patterns/SKILL.md) | coding | writes-files | Language-agnostic rules for designing how code fails, covering when to crash versus recover, typed and wrapped errors with context, retry with exponential backoff and jitter only for idempotent work, timeouts on every remote call, and separating what the user sees from what gets logged. |
+| [`estimation-and-scoping`](skills/estimation-and-scoping/SKILL.md) | docs | read-only | Software effort estimation and scope negotiation that breaks a project into small tasks, gives each a best, likely and worst case instead of a single number, surfaces unknowns and time-boxed spikes to resolve them, adds integration, review and release overhead, and offers concrete scope cuts that fit a deadline, finishing with a range and a stated confidence level. |
+| [`evm-dapp-integration`](skills/evm-dapp-integration/SKILL.md) | integrations | network | Connects web frontends and backends to Ethereum and EVM chains with viem (optionally wagmi) or ethers v6, covering EIP-1193 and EIP-6963 wallet discovery and connection, checking and switching chain IDs, typed contract reads, simulating before writes, token amounts kept as bigint with parseUnits and formatUnits against each token's decimals, the transaction lifecycle from signature to receipt status and confirmations, replaced or dropped transactions, event logs, and RPC rate limits and block-range caps. |
+| [`fastapi-patterns`](skills/fastapi-patterns/SKILL.md) | coding | runs-commands | FastAPI service construction with APIRouter modules, Pydantic models as the request and response contract, Depends-based injection for settings, database sessions and the current user, choosing async def versus def per endpoint, consistent error bodies, BackgroundTasks, lifespan startup, and tests through TestClient or httpx with dependency_overrides. |
+| [`ffmpeg-media-processing`](skills/ffmpeg-media-processing/SKILL.md) | coding | runs-commands | FFmpeg and ffprobe command lines for audio and video work - transcoding with libx264, libx265, libvpx-vp9, AAC and Opus, choosing containers, stream copy versus re-encode, frame-accurate trimming, concat demuxer joins, scale and pad filters, burned-in or soft subtitles, thumbnails and contact sheets, HLS VOD ladders, NVENC, VideoToolbox, QSV and VAAPI hardware encoding, and calling ffmpeg safely from code with argument arrays. |
+| [`fhir-integration`](skills/fhir-integration/SKILL.md) | integrations | network | HL7 FHIR R4 and R4B REST client and server work, covering resource modelling and references, search parameters with _include and chained queries, paging through Bundle next links, transaction and batch bundles with urn:uuid references, SMART on FHIR authorization (EHR and standalone launch, v2 scopes, PKCE, backend services), profile validation with $validate and the HL7 validator, and testing against public sandboxes. |
+| [`flask-patterns`](skills/flask-patterns/SKILL.md) | coding | runs-commands | Flask application structure with a create_app factory, blueprints per feature, config loaded from objects and environment variables, extensions such as Flask-SQLAlchemy and Flask-Migrate initialised with init_app, application and request context pitfalls with current_app and g, security hardening, and pytest tests through the test client. |
+| [`flutter-patterns`](skills/flutter-patterns/SKILL.md) | coding | runs-commands | Flutter app architecture from the widget tree up, covering small const widgets and composition over inheritance, choosing between Riverpod, Bloc and Provider for state, declarative routing with go_router or Navigator, FutureBuilder and StreamBuilder async UI with loading and error states, rebuild and jank performance, and Dart-to-native platform channels or Pigeon. |
+| [`flutterwave-integration`](skills/flutterwave-integration/SKILL.md) | integrations | network | Builds and reviews Flutterwave v3 payment integrations across African markets, covering Flutterwave Standard hosted checkout, direct charges for mobile money (Ghana, Kenya M-Pesa, Uganda, Francophone) and cards, server-side verification by transaction id, verif-hash webhook checks and fulfilment that runs once per tx_ref. |
+| [`fsharp-patterns`](skills/fsharp-patterns/SKILL.md) | coding | writes-files | Idiomatic F# for writing and restructuring code - discriminated unions and records that make illegal states unrepresentable, Option and Result pipelines instead of exceptions and null, task/async/result computation expressions, compilation-order-aware module layout, and safe .NET interop. |
+| [`fsharp-testing`](skills/fsharp-testing/SKILL.md) | testing | runs-commands | Writes and fixes F# tests with Expecto or xUnit, FsCheck property-based tests for invariants, Unquote quotation assertions, and correct testing of task and async code without blocking. |
+| [`gcp-patterns`](skills/gcp-patterns/SKILL.md) | devops | network | Guides Google Cloud projects through service-account-based IAM without key files, choosing Cloud Run, GKE or Cloud Run functions, Cloud SQL connections through the Auth Proxy or connectors, Cloud Storage access control, Secret Manager, VPC and firewall basics, and the GCP billing gotchas such as idle GKE nodes, egress, and log ingestion. |
+| [`git-workflow`](skills/git-workflow/SKILL.md) | devops | runs-commands | Everyday team git without an interactive editor - feature branches, choosing rebase or merge, resolving conflicts, tidying commits with fixup and autosquash, recovering lost commits through the reflog, and force-pushing with --force-with-lease so nobody's work is overwritten. |
+| [`github-actions-ci`](skills/github-actions-ci/SKILL.md) | devops | runs-commands | Writes, hardens and debugs GitHub Actions workflows under .github/workflows, including triggers and job structure, dependency caching, build matrices, reusable workflows and composite actions, keyless OIDC login to AWS, Google Cloud and Azure, least-privilege GITHUB_TOKEN permissions, SHA-pinned third-party actions, and diagnosing red runs from their logs. |
+| [`github-api-automation`](skills/github-api-automation/SKILL.md) | integrations | network | Scripts and services that drive GitHub through the gh CLI, the REST and GraphQL APIs or a GitHub App, covering the choice between fine-grained tokens and app installation tokens, JWT-to-installation-token exchange, Link-header and cursor pagination, primary and secondary rate limits, X-Hub-Signature-256 webhook verification, and the Actions REST endpoints for dispatching, re-running and reading workflow runs. |
+| [`go-patterns`](skills/go-patterns/SKILL.md) | coding | runs-commands | Idiomatic Go for writing and restructuring code, covering package layout, error wrapping with %w and errors.Is/As, small consumer-side interfaces, context.Context propagation, goroutine and channel patterns that do not leak or race, Go modules hygiene, and golangci-lint setup. |
+| [`go-testing`](skills/go-testing/SKILL.md) | testing | runs-commands | Writes and fixes Go tests with the standard testing package, including table-driven tests with t.Run subtests, t.Helper and t.Cleanup, httptest servers and recorders, hand-written fakes instead of mock frameworks, the race detector, native fuzzing, benchmarks and golden files. |
+| [`hexagonal-architecture`](skills/hexagonal-architecture/SKILL.md) | coding | writes-files | Applies ports and adapters (hexagonal, clean or onion architecture) pragmatically, keeping domain rules and use cases free of framework, database and HTTP imports, pointing dependencies inward, and untangling an existing codebase one seam at a time. |
+| [`hipaa-compliance`](skills/hipaa-compliance/SKILL.md) | compliance | writes-files | Engineering rules for US HIPAA work on protected health information (PHI and ePHI), covering whether HIPAA applies, Security Rule safeguards such as role-based access, audit trails, encryption and automatic logoff, business associate agreements with cloud, email, SMS and AI vendors, the minimum necessary standard, de-identification, PHI-free logging, and breach readiness, with a clear not-legal-advice line. |
+| [`hl7v2-integration`](skills/hl7v2-integration/SKILL.md) | integrations | network | Parses, generates and routes pipe-delimited HL7 version 2.x messages such as ADT admit/discharge/transfer events, ORM and OML orders and ORU results, handling MSH encoding characters and escape sequences, repeating fields and components, MSH-10 control IDs, original and enhanced ACK/NACK modes, MLLP framing over TCP, interface engines like Mirth Connect (NextGen Connect), and mapping v2 segments to FHIR resources. |
+| [`homelab-network-setup`](skills/homelab-network-setup/SKILL.md) | devops | writes-files | Plans and builds a self-hosted home lab network from an address and VLAN plan through inter-VLAN firewall policy, local DNS filtering with Pi-hole or AdGuard Home, WireGuard remote access, configuration backups, and exposing a few services to the internet without opening the whole LAN. |
+| [`hubtel-integration`](skills/hubtel-integration/SKILL.md) | integrations | network | Guides Ghana-focused Hubtel merchant integrations end to end, from Online Checkout (redirect or onsite iframe) and Direct Receive Money prompts on MTN, Telecel and AirtelTigo wallets to callback handling, the mandatory Transaction Status Check, Basic auth with API ID and key, the 4-IP whitelist, and sending SMS through the Hubtel SMS API. |
+| [`i18n-localization`](skills/i18n-localization/SKILL.md) | coding | writes-files | Internationalises an application so it can ship in more languages and regions, by moving user-facing text into message catalogs, writing ICU MessageFormat messages with plural and select rules, formatting dates, numbers, currency and lists through locale-aware APIs, making layouts work right-to-left, testing with pseudo-localisation, and keeping translation keys in sync across locales. |
+| [`incident-postmortem`](skills/incident-postmortem/SKILL.md) | docs | runs-commands | Blameless post-incident review writing that rebuilds a timestamped timeline from alerts, chat and deploy logs, quantifies customer and business impact, separates the trigger from root causes and contributing factors, records what went well and where the team got lucky, and turns findings into a short list of owned, dated action items with a follow-up review. |
+| [`inventory-demand-planning`](skills/inventory-demand-planning/SKILL.md) | business | writes-files | Inventory and demand planning for stocked SKUs, from cleaning sales history and picking a simple forecast to sizing safety stock for a target service level, setting reorder points and order quantities from lead times, ranking items with ABC analysis, and weighing stockout cost against overstock cost, built as a spreadsheet or a small script. |
+| [`investor-materials`](skills/investor-materials/SKILL.md) | business | read-only | Drafts startup fundraising documents, namely a pitch deck outline, a one-page investor summary and the recurring investor update, built around a clear narrative, the few metrics investors judge a company on, a specific ask and use of funds. |
+| [`invoicing-and-tax`](skills/invoicing-and-tax/SKILL.md) | business | writes-files | Guides software teams through issuing legally usable invoices and charging sales tax, VAT or GST correctly, covering required invoice fields and sequential numbering, choosing a tax calculation service or merchant of record over hand-rolled rate tables, registration thresholds and nexus at a high level, reverse charge for B2B, tax-inclusive versus exclusive pricing, line-level rounding, and national e-invoicing mandates such as Peppol, KSeF and Factur-X, with a firm handoff to a qualified accountant for anything that is a tax position. |
+| [`java-patterns`](skills/java-patterns/SKILL.md) | coding | writes-files | Idiomatic modern Java (17 and 21 LTS and later) for writing and restructuring code with records, sealed interfaces, switch pattern matching, Optional, streams, checked versus unchecked exceptions, immutable collections, virtual threads and a standard Maven or Gradle layout. |
+| [`java-testing`](skills/java-testing/SKILL.md) | testing | runs-commands | Writes and repairs JVM tests in Java with JUnit Jupiter, AssertJ assertions, Mockito mocks, parameterized cases, Testcontainers-backed integration tests and Spring Boot test slices, and tracks down flaky tests. |
+| [`jetpack-compose-patterns`](skills/jetpack-compose-patterns/SKILL.md) | coding | runs-commands | Android Jetpack Compose UI work centred on hoisting state into stateless composables, understanding recomposition, stability and strong skipping, choosing the right side-effect API (LaunchedEffect, DisposableEffect, rememberUpdatedState, derivedStateOf, snapshotFlow), exposing ViewModel state with collectAsStateWithLifecycle, type-safe Navigation Compose routes, and lazy-list and baseline-profile performance. |
+| [`jira-integration`](skills/jira-integration/SKILL.md) | integrations | network | Connects code to Jira Cloud through the REST API v3, from picking basic auth with an Atlassian API token or OAuth 2.0 (3LO) with a cloudId, through enhanced JQL search on /rest/api/3/search/jql with nextPageToken paging, creating issues with Atlassian Document Format bodies, looking up custom field IDs and running workflow transitions, to registering webhooks and coping with 429 burst and points-based quotas. |
+| [`jpa-hibernate`](skills/jpa-hibernate/SKILL.md) | data | runs-commands | Jakarta Persistence and Hibernate ORM data-layer rules for entity and association mapping, LAZY-by-default fetch plans, finding and fixing N+1 selects with JOIN FETCH, entity graphs or batch fetching, transaction scope and LazyInitializationException, @Version optimistic locking, and evolving the schema through Flyway or Liquibase rather than ddl-auto. |
+| [`kotlin-multiplatform`](skills/kotlin-multiplatform/SKILL.md) | coding | runs-commands | Sets up and evolves Kotlin Multiplatform (KMP) and Compose Multiplatform projects, covering the shared module and source-set layout (commonMain, androidMain, iosMain), expect/actual versus interfaces with injected platform implementations, choosing multiplatform-ready libraries, exporting a framework to Xcode, exposing suspend functions and Flows to Swift, and Gradle build setup for Android and iOS targets. |
+| [`kotlin-patterns`](skills/kotlin-patterns/SKILL.md) | coding | writes-files | Idiomatic Kotlin for JVM and Android code, covering null safety without !!, data and sealed classes with exhaustive when, restrained extension functions, structured concurrency with coroutine scopes and dispatchers, cold Flow versus StateFlow and SharedFlow, Result and exception handling, and Gradle Kotlin DSL build scripts with version catalogs. |
+| [`kotlin-testing`](skills/kotlin-testing/SKILL.md) | testing | runs-commands | Writes and repairs Kotlin tests on JUnit 5 or Kotest, with MockK for coroutine-aware mocks, kotlinx-coroutines-test for runTest, virtual time and Dispatchers.setMain, and Turbine for asserting Flow and StateFlow emissions, plus a checklist for making flaky coroutine tests deterministic. |
+| [`ktor-patterns`](skills/ktor-patterns/SKILL.md) | coding | runs-commands | Kotlin Ktor server guidance for Application modules, the routing DSL, installing ContentNegotiation with kotlinx.serialization, Authentication (JWT, bearer, sessions), StatusPages error mapping, structured coroutines and Dispatchers.IO for blocking work, wiring dependencies with Ktor DI or Koin, and in-process tests with testApplication. |
+| [`kubernetes-patterns`](skills/kubernetes-patterns/SKILL.md) | devops | runs-commands | Kubernetes workload manifests and day-two operations with kubectl, covering Deployments, startup, readiness and liveness probes, CPU and memory requests and limits, ConfigMaps and Secrets, rolling updates and rollbacks, HorizontalPodAutoscaler, PodDisruptionBudgets and a step-by-step pod debugging routine. |
+| [`laravel-patterns`](skills/laravel-patterns/SKILL.md) | coding | runs-commands | Laravel application conventions for routes, controllers and Eloquent models, with N+1 detection through eager loading and preventLazyLoading, validation in Form Request classes, authorization through policies and gates, queued jobs that dispatch after commit, config caching and the env() trap, mass-assignment and other framework security defaults, and feature tests in Pest or PHPUnit using RefreshDatabase and fakes. |
+| [`linear-integration`](skills/linear-integration/SKILL.md) | integrations | network | Talks to Linear's GraphQL API at api.linear.app/graphql with the @linear/sdk or raw queries, covering personal API keys versus OAuth 2.0 apps (actor=app, 24-hour access tokens with refresh, client credentials), querying and mutating issues, projects, cycles, teams and workflow states, Relay-style first/after cursor pagination, Linear-Signature HMAC webhook checks with the webhookTimestamp replay window, and request plus complexity rate limits reported as RATELIMITED errors. |
+| [`literature-review`](skills/literature-review/SKILL.md) | data | network | Scientific literature review that plans a reproducible search across PubMed, Google Scholar and arXiv, screens papers against written inclusion and exclusion criteria, appraises study design and risk of bias, extracts effect sizes into a table, cites each claim to a DOI or PMID, and states how certain the evidence is. |
+| [`llm-app-patterns`](skills/llm-app-patterns/SKILL.md) | ai | writes-files | Engineering patterns for shipping LLM-backed product features in application code, covering schema-validated structured output, timeouts and bounded retries, streaming responses, prompt caching and token budgets, choosing a model tier, defending against prompt injection from untrusted content, and logging each call so it can be evaluated later. |
+| [`llm-evals`](skills/llm-evals/SKILL.md) | ai | runs-commands | Builds and runs evaluation suites that measure whether an LLM feature is good enough to ship, from assembling a versioned case set and choosing graders (exact match, code checks, rubrics, a judge model) to tracking scores across prompt and model changes, keeping test cases out of prompts and training data, and deciding when people must review outputs. |
+| [`logistics-exception-management`](skills/logistics-exception-management/SKILL.md) | business | writes-files | Shipment exception handling for parcels and freight that are late, damaged, lost, refused or stuck on a bad address, covering triage by exception type, evidence capture, carrier claim deadlines, customer messages, SLA clocks and a root-cause log that shows which lane, carrier or packaging keeps failing. |
+| [`manim-animations`](skills/manim-animations/SKILL.md) | coding | runs-commands | Manim Community Edition (the manim Python package, not 3b1b manimgl) for math and explainer animations, covering Scene construct methods, Mobjects and VGroups, play with the .animate syntax, Transform versus ReplacementTransform, ValueTracker updaters and always_redraw, MathTex and Tex with a LaTeX install, and render quality flags from -ql drafts to -qk 4K. |
+| [`market-research`](skills/market-research/SKILL.md) | business | network | Structured market and competitor analysis that sizes a market top-down and bottom-up (TAM, SAM, SOM), builds a competitor feature and pricing matrix, defines customer segments, and attaches a source and a confidence level to every figure. |
+| [`marketing-campaign`](skills/marketing-campaign/SKILL.md) | business | read-only | Builds a go-to-market or promotional campaign plan with one measurable objective, a defined audience, positioning and core message, a channel mix, a week-by-week calendar, a budget split and the metrics that decide success. |
+| [`mcp-server-patterns`](skills/mcp-server-patterns/SKILL.md) | ai | runs-commands | Model Context Protocol server construction, from naming tools and writing their JSON Schema inputs to returning isError results, structured output, tool annotations, OAuth-protected Streamable HTTP or local stdio transports, and testing with the MCP Inspector. |
+| [`metrics-dashboards`](skills/metrics-dashboards/SKILL.md) | data | read-only | Designs business and product metric dashboards that people act on, starting from the decisions the audience makes, writing each metric as a precise definition with formula, grain, filters, time zone and owner, picking a chart type per question, laying out headline numbers then trends then breakdowns, showing data freshness and quality status on the page, and cutting vanity metrics that never change a decision. |
+| [`ml-experiment-workflow`](skills/ml-experiment-workflow/SKILL.md) | ai | runs-commands | Plans and runs machine learning experiments so results can be trusted, from a dumb baseline and leakage-free train, validation and test splits, through tracked runs, metrics chosen to match the business goal, and ablations, to turning a notebook into a repeatable pipeline. |
+| [`mongodb-patterns`](skills/mongodb-patterns/SKILL.md) | data | runs-commands | MongoDB document modelling and query tuning, from embed-versus-reference decisions and unbounded-array traps to compound indexes ordered by the ESR rule, reading explain executionStats, aggregation pipelines, multi-document transactions on replica sets, and $jsonSchema collection validation. |
+| [`mpesa-daraja-integration`](skills/mpesa-daraja-integration/SKILL.md) | integrations | network | Implements and audits direct Safaricom M-Pesa integrations on the Daraja API in Kenya, including the OAuth client-credentials token, Lipa na M-Pesa Online (STK Push) with the base64 shortcode+passkey+timestamp password, stkCallback parsing, confirmation through the STK Push Query endpoint, C2B URL registration with validation and confirmation, B2C payouts with SecurityCredential, and the sandbox-to-production go-live path. |
+| [`mtn-momo-integration`](skills/mtn-momo-integration/SKILL.md) | integrations | network | Builds and reviews direct integrations with the MTN Mobile Money (MoMo) Open API from momodeveloper.mtn.com, including Collection request-to-pay, Disbursement transfers and refunds, API user and access token handling, X-Reference-Id idempotency, unsigned callbacks confirmed by status checks, and sandbox testing for MTN markets such as Ghana, Uganda and Cameroon. |
+| [`mysql-patterns`](skills/mysql-patterns/SKILL.md) | data | runs-commands | MySQL and MariaDB on InnoDB, covering clustered primary keys and secondary index design, reading EXPLAIN and EXPLAIN ANALYZE output, utf8mb4 character sets and collations, REPEATABLE READ with gap and next-key locks, deadlock diagnosis, online DDL algorithms, and stale reads from lagging replicas. |
+| [`nestjs-patterns`](skills/nestjs-patterns/SKILL.md) | coding | writes-files | NestJS application structure and conventions, covering feature modules, providers and dependency-injection scopes, ValidationPipe with class-validator DTOs, guards, interceptors, exception filters, ConfigModule, database modules (TypeORM, Prisma, Mongoose) and Test.createTestingModule unit and e2e tests. |
+| [`network-automation`](skills/network-automation/SKILL.md) | devops | network | Automates configuration of routers, switches and firewalls with Netmiko, NAPALM, Nornir or Ansible network collections, building a source-of-truth inventory, idempotent templates and resource modules, dry runs that show a diff before any push, commit-confirm style rollback, vaulted credentials, and testing against a containerlab or CML lab before production. |
+| [`network-troubleshooting`](skills/network-troubleshooting/SKILL.md) | devops | runs-commands | Layer-by-layer diagnosis of network faults on Linux, macOS and Windows, working up from link and IP routing through DNS resolution, TCP/UDP port reachability and firewalls, TLS certificates and SNI, to latency, packet loss and MTU black holes, with the exact command for each check and how to read its output. |
+| [`nextjs-patterns`](skills/nextjs-patterns/SKILL.md) | coding | runs-commands | Next.js App Router conventions for the app/ directory - splitting Server and Client Components, async params and request APIs, fetch caching and revalidation (including Cache Components and "use cache"), Route Handlers, Server Actions with auth checks, the Metadata API, middleware/proxy, NEXT_PUBLIC_ environment variables and self-hosting or Vercel deployment traps. |
+| [`node-backend-patterns`](skills/node-backend-patterns/SKILL.md) | coding | writes-files | Production rules for Node.js HTTP services written directly on Express or Fastify, without a full framework, including app/server split, schema validation of request input, centralised error middleware, graceful SIGTERM shutdown, structured pino logging, streaming with pipeline, helmet security headers, CORS and rate limiting. |
+| [`nuxt-patterns`](skills/nuxt-patterns/SKILL.md) | coding | runs-commands | Nuxt 3 and 4 full-stack app guidance for choosing SSR, SPA, prerender or hybrid route rules, fetching data once with useFetch and useAsyncData instead of double-fetching with $fetch, writing Nitro server routes, wiring runtimeConfig secrets, setting SEO metadata, and tracking down hydration mismatches. |
+| [`parallel-agent-orchestration`](skills/parallel-agent-orchestration/SKILL.md) | meta | runs-commands | Fans a large coding job out to several subagents at once and merges the results. |
+| [`paystack-integration`](skills/paystack-integration/SKILL.md) | integrations | network | Builds and reviews Paystack payment integrations, including transaction initialisation, server-side verification, webhooks with HMAC-SHA512 signature checks, idempotent fulfilment, and Ghana mobile money (MTN, Telecel, AT) charges. |
+| [`pci-dss-scope`](skills/pci-dss-scope/SKILL.md) | compliance | writes-files | Shrinks PCI DSS scope by keeping cardholder data off your own systems, using processor-hosted payment pages, redirects or iframe hosted fields, provider tokens instead of card numbers, strict rules on what never to log or store (full PAN, CVV, track data, PIN), and a high-level guide to which self-assessment questionnaire (SAQ A, A-EP, D and others) the design points to, with a clear not-legal-advice and not-QSA line. |
+| [`perl-patterns`](skills/perl-patterns/SKILL.md) | coding | writes-files | Modern Perl 5 conventions for writing and restructuring code - strict and warnings, lexical scope, references and nested data, Moo or Moose classes, try/catch error handling, cpanfile with cpanm or Carton, Perl::Critic policy and taint-safe system calls. |
+| [`perl-testing`](skills/perl-testing/SKILL.md) | testing | runs-commands | Perl test suites with Test::More or Test2::V0, run through prove - writing .t files, subtests, exception and warning checks, mocking with Test::MockModule or Test2::Mock, temp-file fixtures, and coverage reports from Devel::Cover. |
+| [`php-patterns`](skills/php-patterns/SKILL.md) | coding | runs-commands | Modern PHP 8 conventions for writing new code and restructuring old code, covering declare(strict_types=1), typed and readonly properties, backed enums, constructor promotion, exception hierarchies, PSR-4 autoloading through Composer, PSR-12 style, PHPStan or Psalm at a high level, and safe handling of SQL, output escaping, passwords and unserialize. |
+| [`php-testing`](skills/php-testing/SKILL.md) | testing | runs-commands | Writing and fixing PHP test suites with PHPUnit or Pest, including attribute-based data providers and Pest datasets, test doubles via createMock/createStub or Mockery, database tests isolated by transactions, HTTP controller and client tests, and coverage with Xdebug or PCOV. |
+| [`postgres-patterns`](skills/postgres-patterns/SKILL.md) | data | runs-commands | PostgreSQL schema, indexing and query-tuning guide covering data types and constraints, btree, partial, expression and GIN indexes, reading EXPLAIN (ANALYZE, BUFFERS) plans, isolation levels and lock conflicts, JSONB modelling, PgBouncer connection pooling, and pg_dump or point-in-time backups. |
+| [`prd-writing`](skills/prd-writing/SKILL.md) | docs | writes-files | Product requirements document (PRD) drafting that starts from the user problem and the evidence for it, sets goals and explicit non-goals, describes target users and scenarios, writes numbered requirements each with testable acceptance criteria and a priority, picks success and guardrail metrics with baselines, lists open questions with owners, and plans a staged rollout. |
+| [`prisma-patterns`](skills/prisma-patterns/SKILL.md) | data | runs-commands | Prisma ORM practice for TypeScript backends, detecting whether the project is on Prisma 6, 7 or the Prisma 8 contract-based release, then covering schema modelling, the migrate dev versus deploy workflow, include and select to kill N+1 queries, sequential and interactive transactions, pool sizing behind serverless functions and PgBouncer, and injection-safe raw SQL. |
+| [`privacy-compliance`](skills/privacy-compliance/SKILL.md) | compliance | writes-files | Turns data protection law (EU/UK GDPR, Ghana Data Protection Act 2012, Nigeria Data Protection Act 2023, Kenya Data Protection Act 2019) into engineering work on personal data, covering data mapping, lawful basis and consent records, retention and deletion jobs, subject access and erasure requests, cross-border transfers to cloud vendors, and breach notice timelines. |
+| [`production-scheduling`](skills/production-scheduling/SKILL.md) | business | writes-files | Production and job-shop scheduling for factories, print shops, kitchens and other work centres, covering capacity checks, finding the bottleneck, dispatching rules such as SPT, EDD and Johnson's rule, sequence-dependent changeovers, time and WIP buffers, rescheduling after a breakdown or rush order, and when to move from heuristics to a constraint solver like OR-Tools CP-SAT. |
+| [`prompt-engineering`](skills/prompt-engineering/SKILL.md) | ai | runs-commands | Writes, diagnoses and rewrites production prompts for language models, using clear task instructions with the context the model lacks, a few well-chosen examples, an explicit output format, splitting a hard job into chained steps, and proving each revision against a fixed set of test inputs before it ships. |
+| [`python-patterns`](skills/python-patterns/SKILL.md) | coding | runs-commands | Idiomatic modern Python 3 for writing and restructuring application code, covering type hints, dataclasses versus pydantic at trust boundaries, exception design, context managers, pyproject.toml packaging with uv, poetry or pip, ruff and mypy/pyright setup, and asyncio pitfalls. |
+| [`python-testing`](skills/python-testing/SKILL.md) | testing | runs-commands | Writes and repairs pytest suites for Python code using fixtures and conftest.py, parametrize, monkeypatch and unittest.mock, tmp_path, pytest-asyncio for coroutines, coverage with pytest-cov, and a procedure for diagnosing flaky or order-dependent tests. |
+| [`pytorch-patterns`](skills/pytorch-patterns/SKILL.md) | ai | runs-commands | Writes and fixes PyTorch training code, covering nn.Module and training loop structure, device and dtype placement, DataLoader setup, torch.amp mixed precision, checkpoint save and resume, seeding for reproducibility, and tracking down NaN losses and tensor shape errors. |
+| [`quarkus-patterns`](skills/quarkus-patterns/SKILL.md) | coding | runs-commands | Quarkus service conventions for ArC CDI beans, Quarkus REST (formerly RESTEasy Reactive) endpoints, Hibernate ORM with Panache, @ConfigMapping and %dev/%test/%prod profiles, Dev Services containers, GraalVM native-image limits, and @QuarkusTest or @QuarkusIntegrationTest suites. |
+| [`rag-pipeline-patterns`](skills/rag-pipeline-patterns/SKILL.md) | ai | writes-files | Retrieval-augmented generation pipeline design covering document chunking, embedding choice, hybrid keyword plus vector search with reranking, metadata and permission filters, grounded answers with citations, index freshness, and measuring retrieval quality apart from answer quality. |
+| [`rails-patterns`](skills/rails-patterns/SKILL.md) | coding | runs-commands | Ruby on Rails application work that follows the framework's conventions - fat-enough models and thin controllers, Active Record queries without N+1 (includes, preload, strict_loading), strong parameters with params.expect or require/permit, Active Job enqueued after commit, zero-downtime migrations, encrypted credentials, Turbo Frames and Streams, and Rails tests for models, requests, jobs and system flows. |
+| [`react-native-patterns`](skills/react-native-patterns/SKILL.md) | coding | runs-commands | React Native and Expo app guidance for picking a navigation library, keeping global state small, writing or wrapping native modules for the New Architecture, fixing slow lists and needless re-renders, handling iOS versus Android differences, and shipping over-the-air updates with EAS Update without breaking installed binaries. |
+| [`react-patterns`](skills/react-patterns/SKILL.md) | coding | writes-files | React component design rules for function components and hooks, covering where state should live, the Rules of Hooks, effects used only to synchronise with external systems, data fetching without race conditions, controlled and uncontrolled forms with React 19 actions, error boundaries, choosing context versus a state library, and accessible markup. |
+| [`react-performance`](skills/react-performance/SKILL.md) | coding | runs-commands | Measure-first workflow for slow React UIs - profile renders with React DevTools and the Profiler API, cut wasted re-renders with memo, useMemo and useCallback only where the profile shows a win (or let React Compiler do it), virtualise long lists, split code with lazy and Suspense, remove request waterfalls, and shrink the JavaScript bundle. |
+| [`redis-patterns`](skills/redis-patterns/SKILL.md) | data | runs-commands | Redis and Valkey design for application code, covering which data structure fits each job, key naming and TTLs, cache-aside with stampede protection, single-instance locks and their limits, Streams consumer groups versus pub/sub, and maxmemory, eviction and persistence settings. |
+| [`refactoring-safely`](skills/refactoring-safely/SKILL.md) | coding | runs-commands | Step-by-step method for restructuring code while proving its observable behaviour stays identical, by pinning current output with characterisation tests, making one small reversible move at a time, preferring automated IDE-style transformations, and using a strangler fig to replace large legacy modules incrementally. |
+| [`release-management`](skills/release-management/SKILL.md) | devops | runs-commands | Ships a software release end to end - deciding the next semantic version from what changed, updating the changelog, tagging, writing release notes for users, cutting alpha/beta/rc pre-releases, patching an old version from a hotfix branch, and wiring up release tooling such as release-please, semantic-release or Changesets. |
+| [`remotion-video`](skills/remotion-video/SKILL.md) | coding | runs-commands | Remotion video projects written in React, covering Composition and Sequence timing, frame-driven animation with interpolate and spring, staticFile assets, font loading held by delayRender, deterministic rendering with the remotion CLI or renderMedia, and serverless rendering on AWS Lambda with concurrency and S3 privacy settings. |
+| [`returns-reverse-logistics`](skills/returns-reverse-logistics/SKILL.md) | business | writes-files | Returns and reverse-logistics flow design for physical goods, from writing the return policy and issuing RMA authorisations to receiving, inspecting and grading items, routing each one to restock, refurbish, liquidate, recycle or dispose, timing the refund against receipt, and flagging return-fraud patterns such as wardrobing, item swaps and empty boxes. |
+| [`ruby-patterns`](skills/ruby-patterns/SKILL.md) | coding | runs-commands | Ruby 3 idioms for plain Ruby and gem code - small objects with clear responsibilities, blocks and Enumerable over manual loops, custom exception hierarchies and narrow rescue, frozen string literals, keyword arguments, Bundler and Gemfile.lock discipline, RuboCop configuration, optional RBS or Sorbet signatures, and the allocation and lookup mistakes that make Ruby slow. |
+| [`ruby-testing`](skills/ruby-testing/SKILL.md) | testing | runs-commands | Writes and stabilises Ruby test suites in whichever framework the project already runs, RSpec or Minitest, with FactoryBot or fixtures, verifying doubles and stubs, frozen or travelled time, WebMock and VCR to keep tests off the network, and a seed-and-bisect routine for order-dependent or flaky specs. |
+| [`runbook-writing`](skills/runbook-writing/SKILL.md) | docs | runs-commands | Operational runbook and playbook authoring for on-call engineers, built around the alert or symptom that sends someone to the page, ordered read-only diagnosis checks with expected output, copy-paste remediation commands that each carry a rollback and a stop condition, escalation paths with contacts and time limits, verification that service has recovered, and a schedule for testing the runbook in drills. |
+| [`rust-patterns`](skills/rust-patterns/SKILL.md) | coding | runs-commands | Idiomatic Rust design guide covering ownership and borrowing choices, Result-based errors with thiserror in libraries and anyhow in binaries, traits and generics, iterator chains, async with tokio, rules for unsafe, cargo workspaces and clippy settings. |
+| [`rust-testing`](skills/rust-testing/SKILL.md) | testing | runs-commands | Writing and organising tests for Rust crates with cargo test, covering #[cfg(test)] unit modules, integration tests under tests/, doc tests, trait-based fakes and mockall, property tests with proptest, #[tokio::test] for async code, and the cargo test flags for filtering and output. |
+| [`search-first`](skills/search-first/SKILL.md) | meta | network | Reuse-before-build check that runs before writing any new helper, utility, component or integration. |
+| [`security-review`](skills/security-review/SKILL.md) | security | read-only | Security review of a code change or module covering secrets, injection, authentication and authorization, input validation, data exposure, dependencies and unsafe configuration, with findings ranked by severity and concrete fixes. |
+| [`seo-audit`](skills/seo-audit/SKILL.md) | business | network | Technical and on-page SEO audit of a website or its source code, covering crawlability, robots.txt and sitemaps, indexation and canonicals, titles and meta descriptions, structured data, Core Web Vitals, and internal linking, ending in a fix list ranked by impact and effort. |
+| [`session-handoff`](skills/session-handoff/SKILL.md) | meta | writes-files | Writes a structured handoff note into the repo (goal, current state, decisions with reasons, exact next steps, open questions) so a later agent session or a teammate can pick up mid-task, and resumes work from such a note by re-checking it against the code before acting. |
+| [`skill-authoring`](skills/skill-authoring/SKILL.md) | meta | writes-files | Creates or improves an Agent Skill (a SKILL.md folder) so it loads reliably and works unchanged in Claude Code, Codex, OpenCode, Cursor, Gemini CLI, GitHub Copilot and Kete Code, including portable frontmatter, a tight trigger description, short instructions, helper scripts and trigger evals. |
+| [`slack-app-integration`](skills/slack-app-integration/SKILL.md) | integrations | network | Builds Slack apps on the Bolt framework (JavaScript, Python or Java), from the app manifest and minimal bot scopes through Events API subscriptions, slash commands and shortcuts acknowledged within three seconds, Block Kit messages and modals with interactive actions, and v0 HMAC request signing checks, to tiered Web API rate limits with Retry-After, Socket Mode versus HTTP endpoints, and OAuth v2 installs for distributing an app to other workspaces. |
+| [`smart-contract-security`](skills/smart-contract-security/SKILL.md) | security | runs-commands | Security audit procedure for Solidity and EVM smart contracts that maps the system's funds, roles and trust assumptions, then hunts reentrancy (including cross-function and read-only), broken access control, price oracle and flash-loan manipulation, rounding and precision loss in share maths, front-running and MEV exposure, signature replay across chains and nonces, and proxy upgrade risks, backed by Slither static analysis plus Foundry, Echidna or Medusa fuzzing and invariant tests, ending in a severity-rated report with a clear professional-audit boundary. |
+| [`social-media-publishing`](skills/social-media-publishing/SKILL.md) | integrations | network | Posts text, images and video to X, LinkedIn, Facebook Pages and Instagram through their official APIs, covering OAuth app setup and token refresh, the scopes each platform needs, media upload flows, rate and publishing limits, queued scheduling with retries, and per-platform length and formatting rules. |
+| [`solidity-patterns`](skills/solidity-patterns/SKILL.md) | security | runs-commands | Writes Solidity contracts for Ethereum and other EVM chains the safe way, applying checks-effects-interactions ordering, Ownable2Step or AccessControl roles, OpenZeppelin Contracts instead of hand-rolled tokens, a deliberate choice between immutable and UUPS or transparent proxy deployments with ERC-7201 namespaced storage, events for every state change, custom errors and basic gas hygiene, inside a Foundry or Hardhat project with tests. |
+| [`spring-boot-patterns`](skills/spring-boot-patterns/SKILL.md) | coding | runs-commands | Spring Boot application structure and conventions, covering controller-service-repository layering, constructor injection, typed @ConfigurationProperties, @Transactional boundaries, Bean Validation, ProblemDetail error responses, SecurityFilterChain setup, Actuator exposure and focused test slices such as @WebMvcTest and @DataJpaTest. |
+| [`stripe-integration`](skills/stripe-integration/SKILL.md) | integrations | network | Builds and hardens Stripe payments and billing, from Checkout Sessions and Payment Intents with SCA and 3D Secure handling to Stripe-Signature webhook verification on the unparsed request body, Idempotency-Key headers on every POST, subscriptions driven by invoice events, the Billing customer portal, and test clocks for simulating renewals and trial ends. |
+| [`subscription-billing-ops`](skills/subscription-billing-ops/SKILL.md) | business | writes-files | Runs the day-to-day mechanics of recurring revenue in any billing system, whether a provider's billing product or your own ledger, covering plan and price changes with grandfathering, proration on upgrades and downgrades, trials and trial conversion, failed-payment dunning and retry schedules, invoice and credit note lifecycles, cancellation and refund policy, and basic MRR, churn and deferred revenue reporting. |
+| [`svelte-patterns`](skills/svelte-patterns/SKILL.md) | coding | runs-commands | Svelte 5 runes and SvelteKit 2 guidance for $state, $derived, $effect and $props reactivity, snippets instead of slots, universal versus server load functions, form actions with use:enhance and fail(), $lib/server and $env/static/private for server-only code, and SSR traps such as shared module state leaking between users. |
+| [`swift-patterns`](skills/swift-patterns/SKILL.md) | coding | writes-files | Idiomatic Swift 5.x and 6 for writing or restructuring code, covering structs and enums over classes, protocols with associated types and some/any, optional handling without force unwraps, typed and untyped throws, async/await, actors, Sendable and strict concurrency checking, plus Package.swift layout for SwiftPM. |
+| [`swift-testing`](skills/swift-testing/SKILL.md) | testing | runs-commands | Writes and fixes Swift unit, async and UI tests using Apple's Swift Testing framework (@Test, @Suite, #expect, #require, parameterized arguments, confirmation) alongside XCTest, with protocol-based fakes injected through initializers instead of mocking frameworks, and XCUITest basics for UI flows. |
+| [`swiftui-patterns`](skills/swiftui-patterns/SKILL.md) | coding | runs-commands | SwiftUI view design built on structural identity, with property-wrapper choices (@State, @Binding, @Observable models with @Bindable, @Environment), NavigationStack and value-based navigation paths, one-way data flow, keeping body cheap to avoid excess view updates, #Preview setups with sample data, and UIKit interop through UIViewRepresentable and UIHostingController. |
+| [`tdd-workflow`](skills/tdd-workflow/SKILL.md) | testing | runs-commands | Test-first development loop that writes a failing test, makes it pass with the smallest change, then refactors with the suite green. |
+| [`technical-writing`](skills/technical-writing/SKILL.md) | docs | runs-commands | Writes and restructures developer-facing documentation people actually use, such as READMEs, how-to guides, tutorials and API reference, by naming the audience first, organising around the reader's task, shipping copy-paste examples that are run before publishing, and keeping docs beside the code they describe. |
+| [`terraform-patterns`](skills/terraform-patterns/SKILL.md) | devops | runs-commands | Terraform and OpenTofu infrastructure-as-code practice, from root and child module layout, pinned providers and remote state with locking, through per-environment variables, reading a plan before apply, detecting drift, adopting existing resources with import blocks, and renaming or moving resources safely with moved and removed blocks instead of destroy and recreate. |
+| [`test-coverage-improvement`](skills/test-coverage-improvement/SKILL.md) | testing | runs-commands | Raises meaningful test coverage by measuring line and branch coverage, ranking untested code by risk and churn, adding tests that pin observable behaviour rather than executing lines, and using mutation testing (Stryker, PIT, mutmut, cargo-mutants, Infection) to prove the new tests catch faults. |
+| [`threat-modeling`](skills/threat-modeling/SKILL.md) | security | read-only | STRIDE threat modelling for a planned feature or an existing system, done before or alongside the code. |
+| [`typescript-patterns`](skills/typescript-patterns/SKILL.md) | coding | writes-files | Idiomatic TypeScript and modern JavaScript for Node.js and the browser, covering strict tsconfig settings, discriminated unions and narrowing, restrained generics, typed error handling, async/await pitfalls, ESM versus CommonJS packaging, project layout and ESLint/Prettier setup. |
+| [`typescript-testing`](skills/typescript-testing/SKILL.md) | testing | runs-commands | Vitest and Jest test suites for TypeScript and JavaScript projects, picking whichever runner the repo already uses, with module mocks, spies, fake timers, async assertions, fixtures, coverage thresholds and a procedure for diagnosing flaky tests. |
+| [`verification-loop`](skills/verification-loop/SKILL.md) | testing | runs-commands | Pre-merge verification that detects the project's build, lint, type-check and test commands, runs them in order, fixes what it safely can and reports a pass/fail verdict. |
+| [`vite-patterns`](skills/vite-patterns/SKILL.md) | coding | writes-files | Configuring and debugging Vite builds and dev servers, covering vite.config with defineConfig and loadEnv, VITE_ env variables and modes, path aliases, plugin ordering and writing small plugins, library mode with package exports, SSR entry builds, base path and build output, and fixing breakage when moving from webpack or Create React App or across Vite majors (Rollup to Rolldown). |
+| [`vue-patterns`](skills/vue-patterns/SKILL.md) | coding | writes-files | Vue 3 Composition API guidance for writing and fixing single-file components with script setup, covering ref versus reactive, reactivity lost by destructuring, computed and watch rules, composables with cleanup, typed defineProps, defineEmits and defineModel, Pinia stores with storeToRefs, and component tests with Vue Test Utils. |
+| [`web-accessibility`](skills/web-accessibility/SKILL.md) | coding | writes-files | Builds and fixes web UI so it meets WCAG 2.2 Level AA, starting from semantic HTML and adding keyboard support, focus management, labelled forms with announced errors, sufficient colour contrast and ARIA only where native elements fall short, then checks the result with axe and a screen reader. |
+| [`web-performance`](skills/web-performance/SKILL.md) | coding | runs-commands | Measures and improves page speed against Core Web Vitals (LCP, INP, CLS) using field data from CrUX or real-user monitoring and lab runs in Lighthouse and DevTools, then fixes the actual bottleneck, whether that is image and font delivery, render-blocking resources, HTTP caching, or too much JavaScript on the main thread. |
+| [`web-scraping`](skills/web-scraping/SKILL.md) | data | network | Responsible, reliable website scraping and crawling, checking robots.txt and the site's terms before fetching, looking for an official API or feed first, throttling requests with backoff and an identifying User-Agent, parsing static HTML with selectors versus driving a headless browser only when the page needs JavaScript, walking pagination, detecting layout changes, and storing raw responses separately from parsed records. |
+<!-- catalog:end -->
+
+## Agents
+
+Subagents your agent can delegate to. Each runs in its own context and returns a result.
+
+<!-- agents:start -->
+| Name | Category | Risk | What it does |
+|---|---|---|---|
+| [`accessibility-reviewer`](agents/accessibility-reviewer/AGENT.md) | coding | runs-commands | Audits changed UI code and rendered pages for WCAG 2.2 Level AA failures in its own context, and returns element-level findings that each name the success criterion, the file and line, who is blocked, and the exact fix, without editing any files. |
+| [`agent-evaluator`](agents/agent-evaluator/AGENT.md) | ai | runs-commands | Grades the outputs or transcripts of an AI agent or LLM-powered feature against a set of tasks and a scoring rubric in its own context, then returns per-criterion scores and the recurring failure patterns, each backed by quoted examples, while leaving the code and prompts untouched. |
+| [`architect`](agents/architect/AGENT.md) | coding | runs-commands | Software architect subagent that designs a new system or module, or evaluates an existing one, by pinning down constraints and quality attributes, comparing two or three concrete options on their trade-offs, and returning one recommendation with risks and a migration path, all without editing code. |
+| [`billing-reviewer`](agents/billing-reviewer/AGENT.md) | business | runs-commands | Inspects subscription, invoicing and ledger-sync code for defects that put the wrong amount on a customer's bill, such as proration and rounding errors, charges or invoices created twice on renewal or retry, billing periods shifted by timezones, DST or month-end anchors, refunds issued without a matching credit note, issued invoices edited in place, and tax computed on the wrong base or rate, then returns verified findings with a worked example of the wrong bill, without editing any file. |
+| [`code-reviewer`](agents/code-reviewer/AGENT.md) | coding | runs-commands | Reviews a diff or branch for correctness bugs in a separate context and returns a short, verified list of findings ranked by severity, without editing any files. |
+| [`code-simplifier`](agents/code-simplifier/AGENT.md) | coding | runs-commands | Cleans up freshly written or recently modified code by flattening deep nesting, collapsing pointless wrappers and indirection, removing duplicated logic and clarifying names, while keeping behaviour identical and confirming it with the existing test suite. |
+| [`cpp-build-resolver`](agents/cpp-build-resolver/AGENT.md) | coding | runs-commands | Gets a broken C++ build green again by diagnosing compiler errors, linker failures such as undefined reference or LNK2019, CMake configure problems, and vcpkg or Conan dependency issues, then applying the smallest fix and rebuilding to prove it. |
+| [`cpp-reviewer`](agents/cpp-reviewer/AGENT.md) | coding | runs-commands | C++ change reviewer that hunts for undefined behaviour, dangling references and views, use-after-move, memory and handle leaks, data races, broken exception safety and ABI breaks in public headers, then returns ranked, verified findings without editing code. |
+| [`csharp-build-resolver`](agents/csharp-build-resolver/AGENT.md) | coding | runs-commands | Repairs failing .NET builds by reading dotnet restore and dotnet build output and fixing C# compiler errors, NuGet restore failures, package downgrades and version conflicts, target framework and SDK mismatches, and analyzer warnings treated as errors, using the smallest diff and re-running the build to prove it. |
+| [`csharp-reviewer`](agents/csharp-reviewer/AGENT.md) | coding | runs-commands | C# and .NET change reviewer that hunts for async void, sync-over-async deadlocks, nullable-safety holes, undisposed resources, repeated LINQ enumeration, EF Core query mistakes and DI lifetime bugs, then returns verified findings ranked by severity without touching files. |
+| [`dart-build-resolver`](agents/dart-build-resolver/AGENT.md) | coding | runs-commands | Gets a red Dart or Flutter build back to green with the smallest diff, resolving dart analyze and flutter analyze errors, compile failures, pub "version solving failed" dependency conflicts and build_runner code generation problems (stale or conflicting .g.dart and .freezed.dart outputs, missing part directives, generator and analyzer version clashes), then re-runs the failing command to prove it passes. |
+| [`dart-reviewer`](agents/dart-reviewer/AGENT.md) | coding | runs-commands | Dart-language bug hunter for diffs in packages, CLIs, servers and the logic layers of Flutter apps (repositories, blocs, services), checking `!` and `late` null-safety escapes, unawaited or discarded futures, StreamSubscription and StreamController leaks, isolate and port misuse, non-exhaustive sealed switches, plus setState after dispose and side effects in build methods where widgets are touched; it verifies each finding and returns a severity-ranked list without editing files. |
+| [`database-reviewer`](agents/database-reviewer/AGENT.md) | data | runs-commands | Database change auditor for SQL schema files, migrations, ORM models and query code, checking for DDL that takes blocking table locks, unindexed filters and foreign keys, N+1 query loops, destructive or irreversible migrations that can lose data, and transaction bugs such as read-then-write races or missing rollbacks, and returning verified findings by severity without changing anything. |
+| [`django-reviewer`](agents/django-reviewer/AGENT.md) | coding | runs-commands | Django-focused reviewer that inspects a diff or branch for N+1 querysets, raw SQL built from user input, views and DRF endpoints missing authentication or object-level permission checks, migrations that lock or break live tables, and insecure or environment-leaking settings, then returns verified, severity-ranked findings without modifying files. |
+| [`doc-updater`](agents/doc-updater/AGENT.md) | docs | runs-commands | Brings documentation back in line with a code change by reading the diff, finding every README, docs page, docstring, code comment, example and changelog entry that now describes old behaviour, and editing only those documentation files so they match the new code. |
+| [`e2e-runner`](agents/e2e-runner/AGENT.md) | testing | runs-commands | Runs a browser end-to-end suite (Playwright, Cypress, WebdriverIO or Selenium), reproduces each failure, classifies it as a product bug, a flaky test or an environment problem using traces and repeated runs, and repairs only test-side flakiness with a minimal, evidenced diff. |
+| [`fastapi-reviewer`](agents/fastapi-reviewer/AGENT.md) | coding | runs-commands | FastAPI change auditor that traces each touched route and dependency to catch blocking I/O inside async def handlers, database sessions or clients that are never closed, request models that accept unvalidated or server-owned fields, routes that skip or weaken the auth dependency, and responses that expose private fields because response_model is missing, and reports only findings it has confirmed, read-only. |
+| [`flutter-reviewer`](agents/flutter-reviewer/AGENT.md) | coding | runs-commands | Flutter-specific change reviewer that runs in its own context, reads the diff plus the surrounding widgets, and reports verified defects such as widgets rebuilding far more than needed, BuildContext or setState used after an await without a mounted check, controllers, streams and timers never disposed, futures created in build, and code that breaks on iOS, Android or web. |
+| [`fsharp-build-resolver`](agents/fsharp-build-resolver/AGENT.md) | coding | runs-commands | Gets a failing F# build green again by diagnosing compiler errors such as FS0039 from wrong .fsproj compile order, FS0072 and FS0001 type inference failures, FS0030 value restriction, and indentation errors, plus NuGet, FSharp.Core and Paket restore problems, applying the smallest fix and re-running the build to prove it. |
+| [`fsharp-reviewer`](agents/fsharp-reviewer/AGENT.md) | coding | runs-commands | F#-specific change reviewer that hunts for partial functions like List.head and Option.get, exceptions leaking out of Result pipelines, incomplete or wildcard-masked pattern matches, shared mutable state, and nulls arriving from .NET interop, then returns verified findings without editing code. |
+| [`go-build-resolver`](agents/go-build-resolver/AGENT.md) | coding | runs-commands | Repair subagent for broken Go builds that diagnoses go build, go vet and compile errors plus module failures (go.mod and go.sum mismatches, replace directives, version conflicts, missing or ambiguous imports, toolchain directives) and applies the smallest fix, then re-runs the failing command to prove it passes. |
+| [`go-reviewer`](agents/go-reviewer/AGENT.md) | coding | runs-commands | Go-specific reviewer subagent that reads a Go diff or package and reports verified defects such as unchecked errors, leaked goroutines, data races, misused context.Context, nil-pointer dereferences, typed-nil interfaces and slice or map aliasing, ranked by severity and without modifying code. |
+| [`healthcare-reviewer`](agents/healthcare-reviewer/AGENT.md) | compliance | runs-commands | Read-only reviewer for clinical and patient-data code that hunts for patient data leaking into logs, error messages, analytics and URLs, record access with no audit entry, unsafe clinical defaults such as missing data treated as normal or silent unit assumptions, FHIR and HL7 v2 handling bugs like single-page searches, name-based patient matching and ACK-before-persist, and absent consent or break-the-glass checks, returning a ranked list of verified findings without changing any file. |
+| [`i18n-reviewer`](agents/i18n-reviewer/AGENT.md) | coding | runs-commands | Localisation-readiness reviewer that reads a UI diff in its own context and reports verified defects that will break in other languages - user-visible text left out of the message catalog, sentences glued together from fragments, hand-rolled or missing plural forms, dates, numbers and currency formatted without the locale, keys missing from or orphaned in locale files, and layout that won't mirror right-to-left - without editing any files. |
+| [`infra-reviewer`](agents/infra-reviewer/AGENT.md) | devops | runs-commands | Audits infrastructure files in a separate context, covering Dockerfiles, Compose files, Kubernetes manifests and Helm charts, Terraform or OpenTofu code and plans, and CI pipeline configs, and returns verified findings on security misconfiguration, missing resource limits and probes, state and secret exposure, and plan changes that would replace or destroy live resources, without editing files or applying anything. |
+| [`java-build-resolver`](agents/java-build-resolver/AGENT.md) | coding | runs-commands | Repairs failing Maven and Gradle builds for Java projects, covering javac compile errors, unresolved or conflicting dependency versions, annotation processors such as Lombok and MapStruct, and JDK, toolchain or release-level mismatches, using the smallest edit and re-running the build to prove it passes. |
+| [`java-reviewer`](agents/java-reviewer/AGENT.md) | coding | runs-commands | Java-specific code reviewer that inspects a diff for NullPointerException paths, unclosed streams and connections, broken equals/hashCode contracts, data races and lock misuse, swallowed or mis-wrapped exceptions, and misuse of JDK and framework APIs, then returns verified findings without editing files. |
+| [`kotlin-build-resolver`](agents/kotlin-build-resolver/AGENT.md) | coding | runs-commands | Gets a failing Kotlin or Gradle build green again with the smallest possible change, diagnosing compiler errors such as unresolved references and type mismatches, kapt and KSP processor failures, Kotlin Gradle plugin, KSP, Compose compiler and AGP version mismatches, JVM target conflicts and dependency resolution conflicts, then re-runs the failing task to prove the fix. |
+| [`kotlin-reviewer`](agents/kotlin-reviewer/AGENT.md) | coding | runs-commands | Kotlin-specific change reviewer for JVM and Android projects that hunts for !! crashes, coroutine scope leaks, blocking calls on the main thread, swallowed CancellationException, Flow collected twice or outside the lifecycle, and nullable platform types leaking in from Java, then returns verified, ranked findings without touching files. |
+| [`mle-reviewer`](agents/mle-reviewer/AGENT.md) | ai | runs-commands | Audits machine learning code in a separate context for data leakage between splits, train and eval behaving differently, metrics that do not measure the stated goal, unseeded or non-reproducible randomness, and silent tensor shape or broadcasting bugs, then returns verified findings without editing files. |
+| [`network-config-reviewer`](agents/network-config-reviewer/AGENT.md) | devops | runs-commands | Audits firewall rulesets, router exports, VPN configs and DNS server settings (nftables, iptables, ufw, pf, OPNsense/pfSense XML, OpenWrt, MikroTik, WireGuard, OpenVPN, IPsec, Unbound, BIND, dnsmasq) for services exposed to the internet, allow-any or shadowed rules, weak ciphers and key handling, open resolvers, and changes that would lock the admin out, and returns ranked findings with redacted evidence without applying anything. |
+| [`payments-reviewer`](agents/payments-reviewer/AGENT.md) | integrations | runs-commands | Audits payment and billing code for money-losing defects with any provider (Stripe, Paystack, Flutterwave, M-Pesa, MTN MoMo, Hubtel and others), hunting for prices or amounts trusted from the client, webhooks or callbacks acted on without signature or status verification, missing idempotency on charges and fulfilment, float arithmetic on money, leaked secret keys and unhandled pending, failed or reversed states, then returns a ranked, verified list without editing anything. |
+| [`performance-optimizer`](agents/performance-optimizer/AGENT.md) | coding | runs-commands | Measures a specific slow endpoint, job, query or function with a repeatable benchmark and a profiler, pins down the single biggest cost from evidence rather than guesswork, applies the narrowest fix that removes it, and reports timings before and after. |
+| [`perl-build-resolver`](agents/perl-build-resolver/AGENT.md) | coding | runs-commands | Fixes broken Perl installs and startup failures - cpanm or Carton dependency errors, XS modules that fail to compile against missing C headers or libraries, and "Can't locate Foo.pm in @INC" load-path problems - with the smallest change, then re-runs the failing command to prove it works. |
+| [`perl-reviewer`](agents/perl-reviewer/AGENT.md) | coding | runs-commands | Read-only reviewer for Perl 5 diffs that hunts missing strict or warnings, two-arg open and shell-string system or backtick calls, unanchored or injectable regexes, list-versus-scalar context mistakes, unchecked eval and $@ handling, and SQL or command injection, returning verified findings by severity. |
+| [`php-build-resolver`](agents/php-build-resolver/AGENT.md) | coding | runs-commands | Fix-it subagent for PHP projects that will not install, autoload or pass analysis, resolving Composer dependency conflicts and platform requirement errors, "Class not found" PSR-4 autoload mismatches, PHPStan or Psalm failures, and code broken by a PHP version upgrade, through the smallest edit followed by a re-run of the failing command as proof. |
+| [`php-reviewer`](agents/php-reviewer/AGENT.md) | coding | runs-commands | PHP-focused review subagent that inspects a PHP diff, pull request or directory and returns severity-ranked, verified findings on SQL injection, cross-site scripting, loose-comparison type juggling, files missing declare(strict_types=1), unserialize on untrusted data, swallowed exceptions and unchecked false returns, never changing the code itself. |
+| [`planner`](agents/planner/AGENT.md) | coding | runs-commands | Implementation planning subagent that reads the codebase and turns a feature request or change into an ordered, step-by-step plan naming the exact files to touch, the tests to write first, the risks, and a checkpoint command after each step, all without editing code. |
+| [`pr-test-analyzer`](agents/pr-test-analyzer/AGENT.md) | testing | runs-commands | Audits the tests that accompany a pull request or branch against the behaviour it changes, mapping each changed branch to the test that covers it, flagging untested cases, assertions too weak to fail and mocks that replace the code under test, and returns a ranked list of specific tests to add, without editing files. |
+| [`python-build-resolver`](agents/python-build-resolver/AGENT.md) | coding | runs-commands | Diagnoses and repairs broken Python builds and environments with the smallest possible change, covering ModuleNotFoundError and import errors, pip, uv and poetry dependency resolution conflicts, stale lockfiles, pyproject.toml packaging and build-backend failures, mypy or pyright type errors, and wrong-interpreter or virtualenv mix-ups, then re-runs the failing command to prove it passes. |
+| [`python-reviewer`](agents/python-reviewer/AGENT.md) | coding | runs-commands | Python-specific change reviewer that hunts mutable default arguments, swallowed or over-broad exceptions, missing or wrong type hints, blocking calls and unawaited coroutines in asyncio code, unclosed files and connections, SQL and shell injection, and plain logic bugs, then returns verified findings ranked by severity without touching the code. |
+| [`rag-reviewer`](agents/rag-reviewer/AGENT.md) | ai | runs-commands | Audits the code and configuration of a retrieval-augmented generation pipeline (ingestion, chunking, embeddings, vector and keyword search, reranking, permission filters, prompt assembly, citations, index freshness and evals) and returns ranked weaknesses, each with a concrete fix, while leaving every file untouched. |
+| [`react-reviewer`](agents/react-reviewer/AGENT.md) | coding | runs-commands | React and Next.js change reviewer that reads a diff in its own context and reports verified defects - Rules of Hooks violations, effects with missing or wrong dependencies and no cleanup, stale closures, unstable or index keys, state mirrored from props, "use client"/"use server" boundary leaks of secrets or server data, unprotected Server Actions, and accessibility regressions - without editing files. |
+| [`refactor-cleaner`](agents/refactor-cleaner/AGENT.md) | coding | runs-commands | Removes dead code from a repository, including unreferenced functions and files, unused exports, unused package dependencies and duplicated helper functions, but only after gathering evidence that nothing uses each item, and runs the tests after every single deletion. |
+| [`ruby-build-resolver`](agents/ruby-build-resolver/AGENT.md) | coding | runs-commands | Repair subagent that gets a broken Ruby environment loading again by fixing Bundler resolution conflicts, lockfile platform mismatches, gem native extension compile failures (nokogiri, pg, mysql2, ffi, psych), LoadError and load path problems, and Ruby version mismatches with the smallest possible change, then re-runs the failing command as proof. |
+| [`ruby-reviewer`](agents/ruby-reviewer/AGENT.md) | coding | runs-commands | Read-only review subagent for Ruby and Rails diffs that hunts NoMethodError on nil, rescue clauses that swallow everything, N+1 queries and missing eager loading, risky metaprogramming such as send or constantize on user input, unpermitted mass assignment, and SQL, shell or YAML injection, then returns verified findings ranked by severity. |
+| [`rust-build-resolver`](agents/rust-build-resolver/AGENT.md) | coding | runs-commands | Repairs failing cargo build, cargo check and cargo test compilation by reading rustc error codes and fixing borrow checker conflicts, lifetime mismatches, unsatisfied trait bounds, missing feature flags and conflicting dependency versions with the smallest diff, then re-running cargo to prove the build is green. |
+| [`rust-reviewer`](agents/rust-reviewer/AGENT.md) | coding | runs-commands | Rust-specific change reviewer that hunts for unwrap and expect outside tests, reachable panics and indexing, unsound or undocumented unsafe blocks, blocking calls and std Mutex guards held across await in tokio code, needless clones, and swallowed or stringly-typed errors, then returns verified findings without touching files. |
+| [`security-reviewer`](agents/security-reviewer/AGENT.md) | security | runs-commands | Isolated security pass over a diff, branch or pull request that traces untrusted input to where it is used and reports only exploitable problems - leaked secrets, SQL, shell and template injection, path traversal and SSRF, missing or broken authorization (IDOR), weak input validation, and sensitive data in responses or logs - each ranked by severity with an attack scenario and a fix, never modifying the code. |
+| [`silent-failure-hunter`](agents/silent-failure-hunter/AGENT.md) | coding | runs-commands | Read-only auditor that searches a diff, module or service for places where failures vanish without a trace, such as empty or catch-all exception handlers, discarded error returns, unawaited promises, fallback values that mask a broken dependency, and error paths with no log or metric, then reports each with its concrete consequence. |
+| [`solidity-reviewer`](agents/solidity-reviewer/AGENT.md) | security | runs-commands | Read-only Solidity diff reviewer that inspects changed contracts in its own context for reentrancy through external calls made before state updates, privileged or initializer functions left without access control, low-level calls whose return value is ignored, unsafe downcasts and rounding that favours the caller, storage layout collisions between proxy implementation versions, and state changes that emit no event, then returns line-anchored findings it has traced or proven with a test, never editing files. |
+| [`swift-build-resolver`](agents/swift-build-resolver/AGENT.md) | coding | runs-commands | Repairs failing Swift and Xcode builds with the smallest diff, working through compiler errors, Swift 6 strict concurrency diagnostics such as non-Sendable sends and actor-isolated access, SwiftPM dependency resolution and Package.resolved conflicts, and build settings like SWIFT_VERSION or search paths, then re-runs the failing build to prove it passes. |
+| [`swift-reviewer`](agents/swift-reviewer/AGENT.md) | coding | runs-commands | Read-only Swift code reviewer that inspects a diff for crash-prone force unwraps and try!, retain cycles in escaping closures, actor isolation mistakes and Sendable violations, UIKit or SwiftUI state touched off the main actor, and swallowed or misrouted errors, then returns verified findings ranked by severity. |
+| [`typescript-build-resolver`](agents/typescript-build-resolver/AGENT.md) | coding | runs-commands | Repairs failing TypeScript and JavaScript builds with the smallest diff, working through tsc type errors, "Cannot find module" and module resolution failures, ESM/CJS interop errors, bundler (Vite, webpack, esbuild, tsup) failures and broken or mismatched npm/pnpm dependencies, then re-runs the failing command to prove it passes. |
+| [`typescript-reviewer`](agents/typescript-reviewer/AGENT.md) | coding | runs-commands | TypeScript and JavaScript diff reviewer that hunts type holes (any, unsafe casts, non-null assertions, ts-ignore), floating or unhandled promises, async races, ESM/CommonJS import breakage and runtime bugs the compiler cannot see, then returns verified findings without touching files. |
+| [`vue-reviewer`](agents/vue-reviewer/AGENT.md) | coding | runs-commands | Read-only reviewer for Vue 3 and Nuxt diffs that hunts for state which silently stops being reactive, watchers and listeners never torn down, props or store state mutated from a child, server and client rendering that disagree, and Nuxt data fetched twice or secrets exposed through public runtime config, then returns verified findings with file and line. |
+<!-- agents:end -->
+
+## Commands
+
+Slash commands you type, for example `/verify`. Supported in Claude Code, OpenCode, Gemini CLI and Kete Code; other hosts are folding commands into skills, so use the matching skill there.
+
+<!-- commands:start -->
+| Name | Category | Risk | What it does |
+|---|---|---|---|
+| [`/aside`](commands/aside.md) | meta | read-only | Answer a quick side question without changing files or losing the thread of the current task, then pick the task up where it was. |
+| [`/build-fix`](commands/build-fix.md) | coding | runs-commands | Fix the current build, compile or type-check failure with the smallest change, routed to the build resolver for that language. |
+| [`/campaign`](commands/campaign.md) | business | read-only | Plan a marketing campaign: audience, positioning, channels, messages, calendar, budget split and success metrics. |
+| [`/changelog`](commands/changelog.md) | meta | writes-files | Write changelog entries for the changes since the last release tag, grouped by type, with breaking changes called out first. |
+| [`/checkpoint`](commands/checkpoint.md) | devops | runs-commands | Save a restorable snapshot of the working tree after running the project's checks, without committing or changing anything, or list and restore earlier ones. |
+| [`/codemap`](commands/codemap.md) | docs | writes-files | Write or refresh a short architecture map of the codebase (entry points, modules, data flow, commands) at docs/CODEMAP.md, so agents can orient without reading everything. |
+| [`/commit`](commands/commit.md) | meta | runs-commands | Write a Conventional Commits message for the staged changes, show it, and commit only after the user confirms. |
+| [`/deps-audit`](commands/deps-audit.md) | security | runs-commands | Audit the project's dependencies for known vulnerabilities, abandoned or risky packages and licence problems, and report fixes by severity. |
+| [`/epic-decompose`](commands/epic-decompose.md) | docs | network | Break a feature or epic into small, independently shippable issues with acceptance criteria, and create them in GitHub, Jira or Linear after approval. |
+| [`/explain`](commands/explain.md) | docs | read-only | Explain how a piece of code or a flow works, tracing it through the codebase with file:line references, without changing anything. |
+| [`/feature-dev`](commands/feature-dev.md) | coding | writes-files | Build a feature end to end: plan it, implement it test-first, review it and verify it, stopping for approval between stages. |
+| [`/hookify`](commands/hookify.md) | security | writes-files | Turn a rule the agent must never break into an enforced hook: write it in the portable Kete Loom hook format, test it with cases, and show how to register it. |
+| [`/i18n-check`](commands/i18n-check.md) | coding | runs-commands | Check the current UI changes for internationalisation problems such as hard-coded strings, concatenation, plurals, and date or currency formatting. |
+| [`/issue-sync`](commands/issue-sync.md) | devops | network | Bring tracked issues in line with the work: find the issues this branch or PR addresses and propose status updates, comments and links, applying them after approval. |
+| [`/jira`](commands/jira.md) | integrations | network | Work with Jira from the agent: find, read, create or update issues with JQL and transitions, asking before any change. |
+| [`/learn`](commands/learn.md) | meta | writes-files | Turn a lesson from this session into a lasting project rule, in AGENTS.md or a Kete Loom rule, so future sessions don't repeat the mistake. |
+| [`/loom`](commands/loom.md) | meta | runs-commands | Find the Kete Loom skills, agents, commands, rules, hooks or MCP servers that fit what you are doing, and show how to install them. |
+| [`/loop`](commands/loop.md) | meta | writes-files | Run a bounded autonomous loop toward a goal, with a stop condition, a budget and a check after every iteration. |
+| [`/model-route`](commands/model-route.md) | ai | read-only | Recommend which model tier to use for a task (fast, balanced or most capable), weighing complexity, risk and cost, and say how to switch in this host. |
+| [`/onboard`](commands/onboard.md) | docs | runs-commands | Get oriented in an unfamiliar codebase: what it does, how it is laid out, how to build, test and run it, and where to start. |
+| [`/orchestrate`](commands/orchestrate.md) | meta | writes-files | Split a large task into independent pieces, run them in parallel subagents, then verify and merge their results. |
+| [`/plan-feature`](commands/plan-feature.md) | meta | read-only | Turn a feature request into a step-by-step implementation plan with files to touch, risks and tests, without writing code. |
+| [`/postmortem`](commands/postmortem.md) | meta | writes-files | Write a blameless postmortem for an incident, with timeline, impact, root cause, contributing factors and owned action items. |
+| [`/pr`](commands/pr.md) | devops | network | Open a pull request for the current branch: check it is ready, write the title and description, push, and create the PR, asking before anything leaves the machine. |
+| [`/pr-describe`](commands/pr-describe.md) | docs | runs-commands | Draft a pull request title and description for the current branch from its commits and diff against the base branch. |
+| [`/prd`](commands/prd.md) | meta | writes-files | Draft a product requirements document for a feature, with problem, users, requirements, success metrics and open questions. |
+| [`/project-init`](commands/project-init.md) | meta | writes-files | Set a repository up for coding agents: write or improve AGENTS.md, install the Kete Loom packs for its stack, and fix what the readiness audit flags. |
+| [`/refactor-clean`](commands/refactor-clean.md) | coding | runs-commands | Find and remove dead code, unused exports and unused dependencies, verifying with the build and tests after each removal. |
+| [`/resume-session`](commands/resume-session.md) | meta | read-only | Resume work from the latest session handoff note, checking it against the repository before taking the next step. |
+| [`/review`](commands/review.md) | coding | runs-commands | Review the current changes for bugs, risky patterns and missing tests, routed to the reviewer for the language that changed. |
+| [`/save-session`](commands/save-session.md) | meta | writes-files | Save a handoff note recording the current goal, progress, decisions and next steps so a later session can resume. |
+| [`/security-scan`](commands/security-scan.md) | security | runs-commands | Scan the current change for vulnerabilities, leaked secrets and unsafe dependencies, and report findings by severity. |
+| [`/sessions`](commands/sessions.md) | meta | writes-files | List the session handoff notes in this repository with their branch, date and next step, and tidy up ones that are finished, only with the user's go-ahead. |
+| [`/skill-create`](commands/skill-create.md) | meta | writes-files | Create a new Agent Skill for a repeated workflow, to the Kete Loom spec, with trigger evals, and check it before use. |
+| [`/tdd`](commands/tdd.md) | testing | runs-commands | Implement the requested change test-first, writing one failing test, the smallest code to pass it, then refactoring, step by step. |
+| [`/test-coverage`](commands/test-coverage.md) | testing | runs-commands | Find untested behaviour in the current change and add focused tests for it, then show the coverage before and after. |
+| [`/threat-model`](commands/threat-model.md) | security | read-only | Produce a threat model for a feature or system, with assets, trust boundaries, data flows, STRIDE threats and ranked mitigations. |
+| [`/update-docs`](commands/update-docs.md) | docs | writes-files | Update the README, API docs, changelog and code comments that the current change made stale, without touching unrelated docs. |
+| [`/verify`](commands/verify.md) | testing | runs-commands | Verify the current changes by running the project's build, lint, type-check and tests, then report pass or fail. |
+<!-- commands:end -->
+
+## Rules
+
+Short, always-on conventions the agent follows without being asked, such as "never build SQL from strings" or "run go vet". Language rules apply only to that language's files where the host supports it (Claude Code, Copilot, Cursor). Kete Code, Gemini CLI, OpenCode and Codex can't limit rules to paths, so they only get the rules you choose, through a marked block in their instructions file.
+
+```bash
+npx @ketecode/loom install --rule common,security,python
+npx @ketecode/loom install --profile core      # common rules plus the ones for your project's languages
+```
+
+<!-- rules:start -->
+| Name | Category | Risk | What it does |
+|---|---|---|---|
+| [`common`](rules/common.md) | coding | read-only | Always-on engineering rules for any project, covering scope, verification, honesty about results, safe changes and secrets. |
+| [`cpp`](rules/cpp.md) | coding | read-only | Always-on rules for modern C++ code, covering ownership and RAII, undefined behaviour, bounds and lifetimes, concurrency, headers, and sanitizer-backed build and test checks. |
+| [`csharp`](rules/csharp.md) | coding | read-only | Always-on rules for C# and .NET code, covering nullable reference types, async and await, disposal, exceptions, data access safety, and build and test checks. |
+| [`dart`](rules/dart.md) | coding | read-only | Always-on rules for Dart and Flutter code, covering null safety, async, widget lifecycle, analysis, formatting and tests. |
+| [`fsharp`](rules/fsharp.md) | coding | read-only | Always-on rules for F# code, covering immutability, discriminated unions and exhaustive matching, Option and Result, async and task code, .NET interop, and checks. |
+| [`git`](rules/git.md) | devops | read-only | Always-on git hygiene rules for agents, covering small focused commits, Conventional Commits messages, keeping secrets and generated files out, safe pushing and never rewriting shared history. |
+| [`go`](rules/go.md) | coding | read-only | Always-on rules for Go files, covering formatting, vet, error handling, context, goroutine and resource lifetimes, and concurrency safety. |
+| [`java`](rules/java.md) | coding | read-only | Always-on rules for Java files, covering build tooling, null handling, exceptions, resources, concurrency and injection safety. |
+| [`kotlin`](rules/kotlin.md) | coding | read-only | Always-on rules for Kotlin code, covering null safety, sealed types, coroutines and structured concurrency, Java interop, and build and test checks. |
+| [`perl`](rules/perl.md) | coding | read-only | Always-on rules for modern Perl 5 code, covering strict and warnings, lexical scope, safe open and system calls, untrusted input, SQL, encoding and tests. |
+| [`php`](rules/php.md) | coding | read-only | Always-on rules for modern PHP 8 code, covering strict types, typed signatures, input handling, SQL, errors, Composer and tests. |
+| [`python`](rules/python.md) | coding | read-only | Always-on rules for Python 3 files, covering environments, type hints, exceptions, resource handling, untrusted input and the project's own tooling. |
+| [`ruby`](rules/ruby.md) | coding | read-only | Always-on rules for Ruby code, covering style, nil handling, exceptions, unsafe input, Bundler, Rails safety and tests. |
+| [`rust`](rules/rust.md) | coding | read-only | Always-on rules for Rust files, covering cargo tooling, error handling, panics, unsafe code, async and dependency hygiene. |
+| [`security`](rules/security.md) | security | read-only | Always-on secure coding rules for any language, covering input validation, injection, authorization, least privilege, deserialisation, dependencies and keeping secrets and personal data out of logs. |
+| [`swift`](rules/swift.md) | coding | read-only | Always-on rules for Swift code, covering optionals, value types, error handling, Swift concurrency and actors, memory and retain cycles, and build and test checks. |
+| [`testing`](rules/testing.md) | testing | read-only | Always-on rules for writing and running tests in any language, covering behaviour-focused tests, failing tests first for bugs, determinism, isolation, speed and running the suite before finishing. |
+| [`typescript`](rules/typescript.md) | coding | read-only | Always-on rules for TypeScript and JavaScript files, covering type safety, untrusted input, async errors, modules and the project's own tooling. |
+<!-- rules:end -->
+
+## Hooks
+
+Checks that run automatically at points in the agent loop: before a shell command or a file edit (and can block it, with a reason the agent sees), after an edit, or when a session starts. Hooks are opt-in: `install` never adds them unless you ask.
+
+```bash
+npx @ketecode/loom install --hook block-dangerous-commands,guard-secrets   # chosen hooks
+npx @ketecode/loom install --hooks                           # everything, plus every hook
+npx @ketecode/loom uninstall --hook block-dangerous-commands
+```
+
+The installer registers each hook with Claude Code and every other host it finds: Claude Code and Gemini CLI in their `settings.json`, Kete Code in `kete.json`, Codex and Cursor in their `hooks.json`, Copilot CLI in `~/.copilot/hooks/` and OpenCode as a plugin. It only adds and removes its own entries, backs a file up to `<file>.kete-loom-backup` before changing it, and never rewrites a file that has comments (it prints the snippet to paste instead). Codex runs a new hook only after you trust it with `/hooks`. Hooks install for your user only, not per project. Cursor has no hook before an edit and OpenCode none that adds context at session start, so those hooks skip them.
+
+<!-- hooks:start -->
+| Name | Category | Risk | What it does |
+|---|---|---|---|
+| [`block-dangerous-commands`](hooks/block-dangerous-commands/HOOK.md) | security | read-only | Stops the agent before it runs shell commands that destroy data or systems, such as rm -rf on / or your home folder, force-pushing main, wiping disks, piping curl into a shell, dropping databases or auto-approved terraform destroy. |
+| [`block-no-verify`](hooks/block-no-verify/HOOK.md) | security | read-only | Stops the agent from skipping the project's git hooks with git commit --no-verify, -n, HUSKY=0, SKIP= or a swapped core.hooksPath, so pre-commit checks keep running. |
+| [`format-on-edit`](hooks/format-on-edit/HOOK.md) | coding | runs-commands | After the agent edits a file, formats it with the formatter the project already uses (Biome or Prettier, Ruff or Black, gofmt, rustfmt), so agent changes match the project's style. |
+| [`guard-secrets`](hooks/guard-secrets/HOOK.md) | security | read-only | Stops the agent from writing API keys, tokens, passwords, connection strings or private keys into files, using the same rules as the security-review secret scanner. |
+| [`load-session-context`](hooks/load-session-context/HOOK.md) | meta | runs-commands | At the start of each session, tells the agent the current branch, how many uncommitted changes there are, and the latest session handoff note, so it picks up where the last session stopped. |
+| [`protect-files`](hooks/protect-files/HOOK.md) | security | read-only | Stops the agent from editing files that should never be hand-edited, such as .env files with secrets, package lockfiles, anything inside .git, and private keys. |
+<!-- hooks:end -->
+
+## MCP servers
+
+Curated MCP server configs, registered with every host you use in that host's own format. None of them puts a token in a config file: remote servers sign in with OAuth through the host (`/mcp` in Claude Code, `codex mcp login`, `kete mcp auth`…), and local servers need no secrets. MCP servers are opt-in: `install` never adds them unless you name them.
+
+```bash
+npx @ketecode/loom install --mcp github,playwright          # chosen servers
+npx @ketecode/loom install --profile mcp-web                # a pack: playwright, chrome-devtools, context7, fetch
+npx @ketecode/loom uninstall --mcp github
+```
+
+Packs: `mcp-web`, `mcp-code` (GitHub, Git, Sentry), `mcp-team` (Linear, Notion, Atlassian), `mcp-cloud` (Cloudflare, Supabase read-only, Stripe), `mcp-design` (Figma). Claude Code servers are added with `claude mcp add-json --scope user` (or `.mcp.json` with `--project`); Codex gets them in a marked block of `config.toml`; Gemini CLI, Cursor, Copilot CLI, OpenCode and Kete Code in their MCP config files. A server you already configured under the same name is never replaced. Copilot CLI gets local servers only, because it has no documented way to sign in to remote ones.
+
+<!-- mcp:start -->
+| Server | Kind | Sign-in | What it does |
+|---|---|---|---|
+| [`atlassian`](mcp/atlassian.json) | remote | OAuth | Atlassian's remote MCP server for Jira and Confluence: issues, pages and search, signed in with Atlassian OAuth. |
+| [`chrome-devtools`](mcp/chrome-devtools.json) | local | none | The Chrome DevTools MCP server: control and inspect a live Chrome, including console, network, performance traces and screenshots. |
+| [`cloudflare`](mcp/cloudflare.json) | remote | OAuth | Cloudflare's remote MCP server for the Cloudflare API and docs, signed in with Cloudflare OAuth. |
+| [`context7`](mcp/context7.json) | remote | OAuth | Context7 by Upstash: up-to-date, version-specific library documentation and code examples for the model. Works without a key at lower rate limits. |
+| [`fetch`](mcp/fetch.json) | local | none | The reference Fetch MCP server: fetch a web page and return it as Markdown for the model to read. |
+| [`figma`](mcp/figma.json) | remote | OAuth | Figma's remote MCP server: bring design context (frames, components, variables) into code, signed in with Figma. |
+| [`git`](mcp/git.json) | local | none | The reference Git MCP server: read history, diffs and status and make commits in a local repository. |
+| [`github`](mcp/github.json) | remote | OAuth | GitHub's official remote MCP server: repositories, issues, pull requests and Actions, signed in with GitHub OAuth. |
+| [`linear`](mcp/linear.json) | remote | OAuth | Linear's remote MCP server: read and update issues, projects and comments, signed in with Linear OAuth. |
+| [`memory`](mcp/memory.json) | local | none | The reference Memory MCP server: a local knowledge graph the agent can store and recall facts in across sessions. |
+| [`notion`](mcp/notion.json) | remote | OAuth | Notion's remote MCP server: search, read and edit pages and databases, signed in with Notion OAuth. |
+| [`playwright`](mcp/playwright.json) | local | none | Microsoft's Playwright MCP server: drive a real browser through the accessibility tree to navigate, click, fill forms and check pages. |
+| [`sentry`](mcp/sentry.json) | remote | OAuth | Sentry's remote MCP server: search errors and issues, inspect events and triage, signed in with Sentry OAuth. |
+| [`stripe`](mcp/stripe.json) | remote | OAuth | Stripe's remote MCP server: work with the Stripe API and search Stripe docs, signed in with Stripe OAuth. |
+| [`supabase`](mcp/supabase.json) | remote | OAuth | Supabase's remote MCP server in read-only mode: inspect projects, schemas and data, and search the docs, signed in with Supabase OAuth. |
+| [`time`](mcp/time.json) | local | none | The reference Time MCP server: current time and timezone conversion. |
+<!-- mcp:end -->
+
+## Housekeeping
+
+```bash
+npx @ketecode/loom@latest update      # refresh exactly what you installed, in the hosts it's in
+npx @ketecode/loom outdated           # installed items older than the latest Kete Loom
+npx @ketecode/loom audit              # score this project's readiness for coding agents, with fixes
+npx @ketecode/loom check ./my-skills  # lint your own skills, agents, commands, rules or hooks
+npx @ketecode/loom doctor             # what is installed where
+```
+
+`audit` checks the things that make agents work well in a repository: agent instructions (`AGENTS.md`/`CLAUDE.md`), the Kete Loom packs for the stack it detects, test and lint commands, CI, the safety hooks, and that `.env` files are ignored and not committed. It exits non-zero when a check fails, so it can run in CI.
+
+Inside your agent, `/loom` finds the right items for a task, `/checkpoint` saves a restorable snapshot without committing, `/sessions` lists and tidies handoff notes, `/codemap` writes a short architecture map, `/model-route` suggests a model tier, and `/aside` answers a side question without derailing the task.
+
+## Where hosts look
+
+### Skills
+
+| Host | User folder | Project folder |
+|---|---|---|
+| Codex, OpenCode, Cursor, Gemini CLI, Copilot, Kete Code | `~/.agents/skills` | `.agents/skills` |
+| Claude Code | `~/.claude/skills` | `.claude/skills` |
+| OpenCode only | `~/.config/opencode/skills` | `.opencode/skills` |
+| Cursor only | `~/.cursor/skills` | `.cursor/skills` |
+| Gemini CLI only | `~/.gemini/skills` | `.gemini/skills` |
+| GitHub Copilot only | `~/.copilot/skills` | `.github/skills` |
+| Kete Code only | `~/.config/kete/skills` | `.kete/skills` |
+
+### Agents and commands
+
+| Host | Agents | Commands | Installed by default |
+|---|---|---|---|
+| Claude Code | `~/.claude/agents` | `~/.claude/commands` | yes |
+| Cursor, VS Code Copilot | read `~/.claude/agents` | not installed (Cursor's are beta; VS Code uses project prompt files) | yes, through Claude's folder |
+| Codex | `~/.codex/agents` (TOML) | deprecated by Codex | when `~/.codex` exists |
+| OpenCode | `~/.config/opencode/agents` | `~/.config/opencode/commands` | when `~/.config/opencode` exists |
+| Kete Code | `~/.config/kete/agents` | `~/.config/kete/commands` | when `~/.config/kete` exists |
+| Gemini CLI | `~/.gemini/agents` | `~/.gemini/commands` (TOML) | when `~/.gemini` exists |
+| Copilot CLI | `~/.copilot/agents` (`.agent.md`) | not supported | with `--target copilot` |
+
+Project installs (`--project`) use the same folders inside the repo (`.github/agents` for Copilot, `.kete/` for Kete Code).
+
+## Contributing
+
+Read [`docs/SKILL_SPEC.md`](docs/SKILL_SPEC.md) (skills, agents and commands) and [`CONTRIBUTING.md`](CONTRIBUTING.md). Every pull request must pass:
+
+```bash
+npm run lint      # frontmatter, length, references, evals, manifest versions
+npm test          # installer and linter tests
+npm run eval      # eval file checks (CI also runs live routing evals)
+```
+
+The `skill-authoring` skill walks your agent through writing a new skill to this standard.
+
+## License
+
+MIT © Kete-org. See [LICENSE](LICENSE).